Exam CAS-004 topic 1 question 508 discussion

Static code analysis involves analyzing the source code for vulnerabilities before the code is even executed. By integrating static code analysis tools into the Continuous Integration / Continuous Deployment (CI/CD) pipeline, the security engineer can automatically detect issues like directory traversal during the development and testing phases, before the code is deployed to production. This approach ensures that vulnerabilities are caught early, making it an effective and scalable solution for preventing flawed code from being deployed.

Static code analysis involves scanning the source code for potential vulnerabilities without executing it. It can identify issues like directory traversal during the development process, before code reaches production. Integrating static analysis into the CI/CD pipeline (Continuous Integration/Continuous Deployment) ensures that every code commit or build is automatically analyzed for security vulnerabilities, including directory traversal flaws, and can be blocked from progressing if issues are detected.

If the question emphasizes short-term mitigation to stop flawed code from reaching production immediately, B (static code analysis in CI/CD) is a good answer. If the question emphasizes long-term prevention and systematic resolution of the issue, D (secure library) is the stronger answer.

B correct