Ann, the software security engineer, works for a major software vendor. Which of the following practices should be implemented to help prevent race conditions, buffer overflows, and other similar…

A product baseline report documents the expected configuration state of a released product and is not a method for detecting coding vulnerabilities before release.

Input validation prevents malicious user-supplied data from being processed at runtime but does not identify race conditions or memory-management flaws in source code logic.

Patch regression testing verifies that applying patches does not break existing functionality but is not a technique for proactively discovering new vulnerabilities in source code before release.

Code review involves developers and security engineers examining source code to identify logic errors, insecure coding patterns, and vulnerabilities like race conditions and buffer overflows before software ships to production. It is a proactive, preventive control that catches defects at the development stage when they are least expensive to remediate. Industry standards including OWASP and the NIST Secure Software Development Framework (SSDF) identify code review as a required practice for secure software development.