Preventing Vulnerable Code Reaching Production with AI
A detection engineering team wants to use AI to automatically prevent vulnerable code from reaching production. Which of the following is the most effective way to accomplish this task?
Community Insight
The question tests where AI-driven automation must sit to be truly preventive; the trap is picking a tool that only warns or only reacts after code has already merged.
This CY0-001 scenario asks how AI can automatically block vulnerable code from reaching production in a detection engineering workflow. The strongest answer is an LLM embedded in the CI/CD runner, because it creates an enforced pass/fail gate rather than a advisory warning or a downstream response.
Option A is the most tempting wrong choice: an IDE plug-in that warns developers only advises at authoring time and depends on a human acting on it, so dangerous code can still compile and ship.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option C places an LLM directly inside the CI/CD runner where every build job passes through a mandatory, machine-enforced checkpoint. Because the model renders a binary pass/fail verdict on the build itself, vulnerable code cannot progress to the production stage without human override, which is the definition of a preventive control rather than a detective or advisory one. The comment from Kristen8730 makes exactly this point: "The model evaluates code and passes/fails the build, creating an automated enforcement point before production." This satisfies the objective of using AI to automate a security task at the point where it can actually stop delivery.Why the Other Options Are Wrong
Option A's IDE plug-in is only advisory and fires before compiling; developers can dismiss the warning or ignore it, so nothing structurally prevents vulnerable code from continuing down the pipeline. Option B's SOAR with an ML classifier operates after signals and findings already exist, making it a reactive triage and orchestration capability rather than a gate on the code delivery path. Option D's agentic penetration testing tool validates and exploits potential weaknesses, which is useful for assurance but does not automatically stop a build from being promoted to production. Only Option C converts AI analysis into an enforced, non-bypassable control in the delivery workflow.Community Comment Notes
Only one comment was provided, and it supports the CI/CD gate reasoning, noting the model "passes/fails the build" to create automated enforcement. No dissenting comment offered a competing option, so the analysis rests on the placement of the control in the pipeline rather than on community voting.Exam Strategy
On CompTIA AI security questions, ask where the control sits in the workflow: controls that block or fail a pipeline stage are preventive, while warnings, triage, and post-incident tooling are advisory or detective. Choose the option that enforces the decision automatically without requiring a human to act.
Frequently Asked Questions
Why isn't an IDE plug-in sufficient to prevent vulnerable code in production?
An IDE plug-in only warns the developer before compiling and can be dismissed or ignored. It is advisory, not enforced, so vulnerable code can still proceed through the pipeline.
Where does a SOAR with an ML code classifier fit in this scenario?
It triages and orchestrates responses to existing findings after they are generated. That is a reactive, post-detection function, not a gate that stops a build from shipping.