IAST works by instrumenting the application with agents that monitor code execution from within while the application is exercised through normal functional or QA testing, allowing it to correlate detected vulnerabilities directly back to specific lines of source code in real time -- precisely what Kenji needs. Penetration testing is typically a manual or semi-manual black-box/gray-box assessment performed by security testers simulating real-world attacks, and does not inherently tie findings to exact source lines through instrumentation during routine QA clicks. Threat modeling is a design-time planning activity performed before code execution. Chaos engineering intentionally injects failures into production or production-like systems to test resilience, not to detect code-level vulnerabilities during functional testing. Because Kenji wants instrumented, line- level detection during live QA interaction, IAST is correct.

Bandit is a Static Application Security Testing (SAST) tool developed specifically for analyzing Python source code. It scans Python scripts and applications to identify common security issues such as use of weak cryptography, hardcoded passwords, unsafe use of functions like eval, and insecure imports. Bandit works by parsing Python Abstract Syntax Trees (ASTs) and applying a set of security-focused rules. It does not support Java, Ruby, or C++ code, which require different static analysis tools tailored to their respective languages. By integrating Bandit with Jenkins during the Build and Test stage, Allen enables automated detection of Python-specific security flaws as soon as code changes are introduced. This shift-left approach reduces remediation costs, prevents vulnerable code from progressing further in the pipeline, and improves overall application security posture.

Container image vulnerability scanners such as Trivy, Clair, or Anchore inspect the layers of a container image, including the base OS packages and installed libraries, against known CVE databases, and can be integrated directly into the Build stage of a CI/CD pipeline to block or flag images before they reach the registry. This precisely matches Oliver's need to catch an outdated OpenSSL package with a known CVE pre-push. A Web Application Firewall protects a running web application at the network edge during Operate, not during image build. A Network Intrusion Detection System monitors network traffic for malicious activity in a live environment, not static image contents. A Git secret scanner detects hardcoded credentials in repository history, not OS package vulnerabilities. Because Oliver needs pre-push detection of vulnerable OS packages inside a container image, a container image vulnerability scanner is correct.

The docker save command exports one or more Docker images to a tar archive by writing the image data to standard output (STDOUT). To redirect this output into a file, the > redirection operator is used. The correct syntax is docker save <image> > <filename>.tar. In this scenario, the image repository name is centos, and the desired archive file is centos-all.tar, making option B correct. Options C and D incorrectly use input redirection (<) instead of output redirection.
Option A includes a space in the filename (centos all.tar), which would be interpreted as two separate arguments and cause an error unless quoted. Saving images to a tar archive is a common operational task used for backups, transfers between environments, or offline analysis during the Operate and Monitor stage.

Ubuntu systems use the Advanced Package Tool (APT) for installing and managing software packages. The correct syntax for installing a package is sudo apt-get install <package-name>. In this case, the OpenSSH server package required for secure remote access is named openssh- server, making sudo apt-get install openssh-server the correct command. Options using apt.get are invalid because the command syntax is incorrect. Options that include the -s flag only simulate the installation process and do not actually install the package. Installing OpenSSH is often required when integrating Docker Bench with Jenkins, as it enables secure communication and remote execution of compliance checks. Performing this setup during the Build and Test stage ensures that container hosts comply with Docker CIS Benchmark recommendations, helping organizations identify misconfigurations and security weaknesses early in the pipeline.