ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question

Running an automated static application security test (SAST) on every code commit integrates security analysis directly into the continuous integration workflow. Because the scanner executes as part of the build job, it can automatically break the build when it detects high-severity findings, ensuring vulnerable code never progresses farther in the pipeline. Quarterly penetration tests and nightly production scans provide useful information but are not continuous or positioned early enough to stop faulty commits. A manual review gate after integration testing adds delay and still relies on human intervention rather than automation, so it does not satisfy the requirement for automatic build rejection.