Which statement best reflects the TA's approach to preventing vulnerabilities during development?

• A. Focusing on speed over security.
• B. Relying solely on automated tests.
• C. Incorporating secure coding practices and reviewing deployment pipelines.
• D. Ignoring security until after deployment.

Answer: (C)

Prevention during development comes from building security into the process itself. By following secure coding practices, developers implement measures like proper input validation, safe handling of authentication and authorization, secure storage of secrets, and secure error handling. These practices reduce the chances that vulnerabilities are introduced in the first place. Pairing that with a reviewed deployment pipeline adds security checks into the release process—dependency scanning, secret scanning, container and infrastructure as code (IaC) hardening, and security gates that must pass before code moves to production. This combination embodies a shift-left approach: issues are caught and addressed early when fixes are cheaper and less risky, rather than after deployment.

Focusing on speed over security compromises protection, and relying solely on automated tests can miss design flaws or insecure configurations. Waiting until after deployment means vulnerabilities are already in production, creating bigger risk and remediation costs.