CAS-003 · Question #828
A software company tripled its workforce by hiring numerous early career developers out of college. The senior development team has a long-running history of secure coding, mostly through experience…
The correct answer is C. Roll out an automated testing and retesting framework. An automated testing and retesting framework embeds security validation directly into the development pipeline, training developers through immediate feedback without requiring them to stop development work.
Question
A software company tripled its workforce by hiring numerous early career developers out of college. The senior development team has a long-running history of secure coding, mostly through experience and extensive peer review, and recognizes it would be infeasible to train the new staff without halting development operations. Therefore, the company needs a strategy that will integrate training on secure code writing while reducing the impact to operations. Which of the following will BEST achieve this goal?
Options
- AGive employees a book on the company coding standards.
- BEnroll new employees in a certification course on software assurance.
- CRoll out an automated testing and retesting framework.
- DDeploy static analysis and quality plug-ins into IDEs.
How the community answered
(55 responses)- A4% (2)
- B13% (7)
- C75% (41)
- D9% (5)
Why each option
An automated testing and retesting framework embeds security validation directly into the development pipeline, training developers through immediate feedback without requiring them to stop development work.
Providing a coding standards book is a passive, reference-only approach that relies entirely on self-study and does not integrate with development workflows or provide active feedback during coding.
Enrolling staff in a certification course requires taking developers off active work for extended periods, which directly conflicts with the requirement to avoid halting development operations.
Automated testing frameworks catch insecure code at the point of writing and provide real-time corrective feedback, which functions as embedded on-the-job training. By continuously retesting against security benchmarks, new developers learn secure patterns iteratively without classroom downtime, directly satisfying the dual requirement of training and operational continuity.
Static analysis IDE plug-ins identify issues in existing code but do not constitute a testing and retesting workflow - they lack the iterative regression and feedback loop needed to train secure coding habits at scale.
Concept tested: DevSecOps - integrating security training via automated testing pipelines
Source: https://owasp.org/www-project-devsecops-guideline/
Topics
Community Discussion
No community discussion yet for this question.