Exam CAS-005 topic 1 question 48 discussion

❌ Why the others are not the best fit: B. Regression testing Checks if recent changes broke existing functionality — it’s not focused on security flaws. C. Code signing Verifies the integrity and authenticity of code, but doesn’t detect vulnerabilities in the code itself. D. Sandboxing Isolates potentially unsafe programs, useful at runtime, but doesn’t prevent vulnerable code from being deployed.

✅ A. Static Application Security Testing (SAST) 🔍 Explanation: The scenario highlights a lack of security controls in the software development life cycle (SDLC), leading to vulnerabilities in production. The best way to prevent vulnerable code from reaching production is to: Identify and fix issues early in the development process. SAST is a tool used during the coding phase to analyze source code, bytecode, or binaries without executing the program. It helps developers detect security flaws early, when they’re cheaper and easier to fix — reducing the risk of deploying vulnerable applications.