CAS-003 · Question #954
A software company tripled its workforce by hiring numerous early career developers out of college. The senior development team has a long-running history of secure coring mostly through experience…
The correct answer is C. Roll out an automated testing and retesting framework. Rolling out an automated testing and retesting framework embeds security feedback directly into the development cycle. New developers learn through rapid, continuous feedback loops: they write code, automated tests flag security issues, and they fix and retest - learning secure…
Question
A software company tripled its workforce by hiring numerous early career developers out of college. The senior development team has a long-running history of secure coring mostly through experience and extensive peer review and recognizes it would be feasible to train the new staff without halting development operations. Therefore the company needs a strategy that will integrate training on secure code writing while reducing the impact to operations. Which of the following will BEST achieve this goal?
Options
- AGive employees a book on the company coring standards
- BEnroll new employees in a certification course on software assurance
- CRoll out an automated testing and retesting framework
- DDeploy static analysis and quality plugins into IDEs
How the community answered
(35 responses)- A3% (1)
- B3% (1)
- C83% (29)
- D11% (4)
Explanation
Rolling out an automated testing and retesting framework embeds security feedback directly into the development cycle. New developers learn through rapid, continuous feedback loops: they write code, automated tests flag security issues, and they fix and retest - learning secure coding practices organically without attending formal training sessions that halt development. This scales well even with a tripled workforce. A book on standards (A) is passive and ineffective for skill development. A certification course (B) takes developers out of the workflow entirely. Static analysis IDE plugins (D) are helpful but only flag issues at write-time, not during the broader testing pipeline - the automated testing framework provides more comprehensive, integrated feedback across the full development process.
Topics
Community Discussion
No community discussion yet for this question.