A development team at Meridian Systems is defining their security testing strategy and plan, and they need guidance on best practices and timing. Which statement is accurate?

Google Cloud Security Command Center is a security management platform, not a statement describing a security testing strategy.

Performing security testing only after deployment is too late in the software development lifecycle, making remediation much more costly and risking live environment exploitation.

A comprehensive security testing strategy integrates both automated vulnerability scans, which are efficient for detecting common issues at scale, and manual penetration testing, which provides in-depth discovery of complex, business-logic flaws.

Focusing security testing solely on the application tier is insufficient, as vulnerabilities can exist and be exploited at the network and host layers, requiring a holistic approach.