A Dockerfile linter such as Hadolint statically analyzes Dockerfile syntax and instructions against established best practices, flagging issues like running containers as the root user, using mutable
"latest" image tags, or including unnecessary packages, and can be configured to fail CI builds when violations are found -- exactly matching Henrik's requirement. A load balancer health check monitors the availability of running application instances and has nothing to do with Dockerfile content analysis. A SIEM correlation rule analyzes security event data from running systems, not static Dockerfile definitions. A Kubernetes NetworkPolicy controls pod-to-pod network traffic at runtime and does not evaluate Dockerfile build instructions. Because Henrik needs static analysis of Dockerfile best practices integrated into CI, a Dockerfile linter is correct.

The git-multimail tool provides a mechanism to verify whether it has been installed and configured correctly before being relied upon for production notifications. This verification is done using an environment variable named GIT_MULTIMAIL_CHECK_SETUP. When this variable is set to a non-empty string, git-multimail performs a setup validation and outputs diagnostic information to confirm that configuration values, hooks, and parameters are correctly defined. This helps prevent silent failures where commits occur but email notifications are not sent. Options that reference GITHUB_MULTIMAIL_CHECK_SETUP are incorrect because git-multimail is not limited to GitHub and does not use that variable name. Additionally, setting the variable to an empty string does not trigger the setup check. Ensuring proper configuration during the Code stage is important because it supports auditability, traceability, and timely communication among development and security teams. Therefore, Brett must run the environment variable GIT_MULTIMAIL_CHECK_SETUP with a non-empty value to ensure the tool is set up appropriately.

Change lead time measures the duration between a code commit and its successful deployment into production. This metric tracks how efficiently new features, bug fixes, and changes move through development, testing, and release stages. It is a key DevSecOps performance indicator used to assess pipeline efficiency and the effectiveness of automation and security integration.
Mean time to recovery focuses on restoring service after incidents, change volume measures the number of changes rather than delivery speed, and time to value is a broader business metric.
Change lead time directly reflects how well DevSecOps practices enable rapid yet secure delivery, making it the correct metric for measuring commit-to-production flow across all phases.

Deploy-time checks are designed to identify vulnerabilities that may not surface during earlier stages such as commit-time, build-time, or test-time checks. These checks analyze applications in environments that closely resemble or are part of production, making it possible to detect configuration issues, runtime vulnerabilities, and environment-specific weaknesses. Pre- production testing often cannot fully replicate production conditions, so deploy-time checks act as an additional safety net. Commit-time and build-time checks focus on code quality and static analysis, while test- time checks validate application behavior in controlled environments. Deploy- time checks therefore help Victor uncover vulnerabilities missed earlier, improving overall security assurance before or during deployment.

To inspect exposed ports for running Docker containers, the recommended approach is to first retrieve container IDs using docker ps --quiet and then pass them to docker inspect. The --format option allows selective output of container configuration details, including port mappings. The command docker ps --quiet | xargs docker inspect --format ': Ports=' correctly extracts port information for each container. Options that include the --all flag or incorrect formatting are not valid for this inspection use case. Checking exposed ports is an important activity in the Operate and Monitor stage because unnecessary open ports increase the attack surface and may violate container security best practices. Regular inspection helps ensure that only required ports are exposed, supporting secure runtime operations.