Question
You have been tasked with strengthening the security of your team's development process.
You need to suggest a security tool type for the Continuous Integration (CI) phase of the development process.
Which of the following is the option you would suggest?
- A. Penetration testing
- B. Static code analysis Correct
- C. Threat modeling
- D. Dynamic code analysis
Explanation
Static code analysis inspects source code without running it, so it fits naturally into the Continuous Integration phase and runs on every build or pull request. Dynamic code analysis and penetration testing need a running, deployed application and belong to later test or release stages. Threat modeling is a design-time activity performed before code is written, not a CI tool.
