The BDD Security framework is executed through Gradle wrapper commands, and the correct wrapper script on Unix-like systems is ./gradlew (dot-slash indicates "run the wrapper from the current directory"). Options using /gradlew or /gradlev imply an absolute path at filesystem root and are typically incorrect for a cloned project. Also, the wrapper name is gradlew, not gradlev.
For executing only the authentication feature (or scenarios tagged for authentication), Cucumber tag expressions are used through the -Dcucumber.options system property. The command must include - -tags @authentication to select authentication-tagged scenarios. To skip scenarios tagged "skip," the exclusion operator is used as --tags ~@skip (meaning "exclude @skip").
Options A and B incorrectly include --tags @skip which would include skipped tests rather than exclude them. Therefore, ./gradlew -Dcucumber.options="--tags @authentication --tags ~@skip" is the correct choice to run authentication scenarios while excluding anything marked to skip.

Security Service Level Objectives (Security SLOs) are specific, measurable security-related targets -- such as vulnerability remediation timeframes based on severity -- that define shared accountability between security and engineering teams, embedding security expectations into the operational culture of DevSecOps, which matches exactly what Chidinma is defining. Service Level Agreements (SLAs) are typically formal, often externally facing contractual commitments (often with penalties) between a provider and a customer, which is broader and less specifically tied to internal security remediation accountability than an SLO. Sprint velocity metrics measure a team's rate of completing story points during sprints and have nothing to do with vulnerability remediation timelines. Network uptime guarantees pertain to availability commitments, not vulnerability management targets. Since Chidinma is defining internal, measurable vulnerability- remediation targets for shared team accountability, Security SLOs is the correct answer.

SAST analyzes source code, bytecode, or binaries "white-box" style without executing the application, making it ideal for detecting insecure coding patterns like SQL injection-prone queries or hardcoded secrets directly in the codebase during the Code stage. DAST, by contrast, requires a running application and tests it externally as a black box, so it cannot be used purely on source code. IAST combines elements of SAST and DAST by instrumenting a running application to observe code execution paths in real time, which also requires execution. RASP is not a testing methodology at all but a runtime defense mechanism embedded in the application to detect and block attacks as they occur in production. Since Grace wants to scan source code without running the application, SAST is correct.

When GitHub Code Scanning is enabled using CodeQL, each supported programming language is identified by a specific language key. For C++ code, CodeQL uses the identifier cpp, not "cp." CodeQL workflows are commonly configured to run during pull request events so that security issues and coding errors can be detected and reviewed before code is merged into the main branch. As a result, the CodeQL analysis entry displayed in GitHub Actions and the Security tab for C++ pull request analysis appears as CodeQL/Analyze (cpp) (pull-request). Options A and B are incorrect because "cp" is not a valid CodeQL language identifier. Option C uses the correct language identifier but references an incorrect event format. Identifying the correct CodeQL analysis entry helps DevSecOps engineers confirm that scans are executing correctly for the intended language during the Code stage and that security feedback is available early in the development lifecycle.

HashiCorp Vault enables authentication mechanisms using the vault auth enable command followed by the name of the authentication method. To enable AppRole authentication, the correct command is vault auth enable approle. AppRole is specifically designed for machine-to- machine authentication, making it ideal for CI/CD tools like Jenkins. It allows applications to authenticate securely using role IDs and secret IDs instead of static credentials. The other options do not follow Vault CLI syntax and would result in command errors. Enabling AppRole during the Build and Test stage ensures that secrets are accessed securely and dynamically, supporting least-privilege access control and reducing the risk of credential leakage across the DevSecOps pipeline.