In the context of DevSecOps, which of the following BEST enables the identification of vulnerabilities before software is released?

The correct answer is D. Automating code review. Automating code review integrates security analysis directly into the CI/CD pipeline, enabling continuous, consistent, and scalable vulnerability detection at every code commit - well before release. This embodies the DevSecOps principle of 'shift-left' security. Following…

Submitted by parkjh· Apr 18, 2026Information Security Program Development and Management

Question

Options

AFollowing secure coding standards
BPerforming integration testing
CTesting executable code
DAutomating code review

How the community answered

(52 responses)

A
17% (9)
B
8% (4)
C
4% (2)
D
71% (37)

Explanation

Automating code review integrates security analysis directly into the CI/CD pipeline, enabling continuous, consistent, and scalable vulnerability detection at every code commit - well before release. This embodies the DevSecOps principle of 'shift-left' security. Following secure coding standards (A) is a preventive practice but does not automatically catch violations. Integration testing (B) verifies functional behavior between components, not security flaws. Testing executable code (C) occurs later in the cycle and misses source-level issues. Automation ensures security checks happen at scale without slowing the development process.

Topics

#DevSecOps#Static Application Security Testing (SAST)#Vulnerability identification#Secure SDLC

Community Discussion

No community discussion yet for this question.

Full CISM Practice