A DevOps team runs security scans only once, two days before each quarterly release. Findings regularly arrive too late to fix, so releases ship with known vulnerabilities or slip. Which change best addresses the problem?
Select an answer to reveal the explanation.
Short Explanation
It's cheaper to catch a typo while you're writing than after the book's printed. Shifting security left puts automated checks in the pipeline so every change gets tested as it's built. The trap is a longer freeze, which just gives you more time to fix a pile that shouldn't have built up.
Full Explanation
DevOps security, often called DevSecOps, integrates security into the continuous integration and delivery pipeline rather than treating it as a gate at the end. Shifting left means static application security testing, software composition analysis for dependencies, secrets detection and infrastructure template checks run automatically on each commit or build, and findings return to the developer while the change is fresh and cheap to fix. Policy thresholds can block builds that introduce critical issues. A longer release freeze keeps the same late, batched scanning and simply trades delivery speed for remediation time, without reducing the number of findings that accumulate. Scanning only after deployment exposes production to known vulnerabilities and moves detection even later, the opposite of what the team needs. Routing results solely to the security team breaks the feedback loop: the people who can fix the code never see the findings, so issues persist and friction grows between teams. Exam caveat: dynamic testing and penetration testing still have a role later in the pipeline; shifting left adds early checks rather than eliminating later ones. Operational check: measure the median time from a finding's creation to its fix before and after pipeline integration, and confirm critical findings block merges.