Preventing Vulnerable Code Reaching Production with AI
Short answer
C Embed an LLM in the CI/CD runner so it automatically examines code and fails build jobs containing vulnerabilities, blocking them before production.
Question
Key Takeaways
The question tests where AI-driven automation must sit to be truly preventive; the trap is picking a tool that only warns or only reacts after code has already merged.
This CY0-001 scenario asks how AI can automatically block vulnerable code from reaching production in a detection engineering workflow. The strongest answer is an LLM embedded in the CI/CD runner, because it creates an enforced pass/fail gate rather than a advisory warning or a downstream response.
Common mistake: Option A is the most tempting wrong choice: an IDE plug-in that warns developers only advises at authoring time and depends on a human acting on it, so dangerous code can still compile and ship.
Expert Analysis
Why the Answer Is Correct
Option C places an LLM directly inside the CI/CD runner where every build job passes through a mandatory, machine-enforced checkpoint. Because the model renders a binary pass/fail verdict on the build itself, vulnerable code cannot progress to the production stage without human override, which is the definition of a preventive control rather than a detective or advisory one. The comment from Kristen8730 makes exactly this point: "The model evaluates code and passes/fails the build, creating an automated enforcement point before production." This satisfies the objective of using AI to automate a security task at the point where it can actually stop delivery.
Why the Other Options Are Wrong
Option A's IDE plug-in is only advisory and fires before compiling; developers can dismiss the warning or ignore it, so nothing structurally prevents vulnerable code from continuing down the pipeline. Option B's SOAR with an ML classifier operates after signals and findings already exist, making it a reactive triage and orchestration capability rather than a gate on the code delivery path. Option D's agentic penetration testing tool validates and exploits potential weaknesses, which is useful for assurance but does not automatically stop a build from being promoted to production. Only Option C converts AI analysis into an enforced, non-bypassable control in the delivery workflow.
Community Comment Notes
Only one comment was provided, and it supports the CI/CD gate reasoning, noting the model "passes/fails the build" to create automated enforcement. No dissenting comment offered a competing option, so the analysis rests on the placement of the control in the pipeline rather than on community voting.
Exam Strategy
On CompTIA AI security questions, ask where the control sits in the workflow: controls that block or fail a pipeline stage are preventive, while warnings, triage, and post-incident tooling are advisory or detective. Choose the option that enforces the decision automatically without requiring a human to act.
Frequently Asked Questions
Why isn't an IDE plug-in sufficient to prevent vulnerable code in production?
Where does a SOAR with an ML code classifier fit in this scenario?
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
Kristen8730 👍 1 Answered CThe model evaluates code and passes/fails the build, creating an automated enforcement point before production
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.