The correct answer is D. Peer review and approval.
Peer review and approval help prevent a single developer or insider from inserting malicious code without oversight. This practice supports separation of duties, accountability, secure software development, and change control. Requiring another qualified person to review and approve code changes increases the chance that suspicious, unauthorized, or malicious code will be identified before it enters production.
Why the other options are incorrect:
A). Code scanning for vulnerabilities
Code scanning can identify known vulnerabilities, insecure coding patterns, and some misconfigurations.
However, malicious code intentionally written to appear legitimate may not always be detected by automated scanning.
B). Open-source component usage
Using open-source components does not prevent insider abuse. In fact, open-source dependencies may introduce additional supply chain risk if not properly reviewed.
C). Quality assurance testing
Quality assurance testing verifies whether software works as intended, but it may not detect intentionally malicious logic hidden in the code.
Therefore, peer review and approval is the best practice to prevent an insider from introducing malicious code into the development process.

Blackmail is the correct motivation because the attacker is coercing the employee by threatening to release sensitive personal files. The attacker is not simply seeking money directly, so financial gain is not the best description. Revenge would involve retaliation for a perceived grievance, but the scenario describes coercion. Espionage involves stealing information for political, corporate, or strategic advantage, which is not the primary driver here. This is a social engineering and insider-risk scenario because an external attacker pressures an internal employee into performing malicious activity.
Security+ expects candidates to recognize attacker motivations such as financial gain, ideology, espionage, revenge, and blackmail based on the pressure or incentive being used.

Hacktivists are individuals or groups who use hacking to promote a political agenda, social cause, or philosophical beliefs. Their primary motivation is not personal gain but rather to draw attention to, or protest against, perceived injustices or causes.
Reference:
CompTIA Security+ SY0-701 Official Study Guide, Domain 2.1: "Hacktivists are motivated by ideology or political/social causes." Exam Objectives 2.1: "Compare and contrast different types of threat actors."