Quick Answer

The correct answer is automating dynamic application security testing (DAST) in a staging environment that mirrors production, along with embedding SAST into the build phase and scanning container images for known vulnerabilities. These three practices form the core of CI/CD pipeline vulnerability scanning best practices because they enforce a shift-left security model: SAST catches code-level flaws like SQL injection during compilation, DAST validates runtime behavior in a realistic staging environment, and container scanning ensures that base images and dependencies are free of known exploits before deployment. On the CompTIA CySA+ CS0-003 exam, this question tests your understanding of DevSecOps integration points—specifically, that security testing must be automated at different pipeline stages rather than performed as a final gate. A common trap is selecting “scanning production systems,” which violates the principle of catching vulnerabilities before they reach live environments. Remember the mnemonic “Build, Stage, Container” to recall the three layers: SAST at build, DAST at staging, and image scanning for containers.