Question
During security scanning, a security analyst regularly finds the same vulnerabilities in a critical application. Which of the following recommendations would best mitigate this problem if applied along the SDLC phase?
- A. Conduct regular red team exercises over the application in production
- B. Ensure that all implemented coding libraries are regularly checked
- C. Use application security scanning as part of the pipeline for the CI/CD flow Correct
- D. Implement proper input validation for any data entry form
Explanation
Building application security scanning (such as SAST and DAST) into the CI/CD pipeline catches vulnerabilities on every build, before code reaches production, so recurring flaws are stopped across the SDLC rather than rediscovered later. Red team exercises in production find problems only after release. Checking libraries and adding input validation each address one class of flaw, not the recurring vulnerabilities in general.
