How do you prove developers are trained on secure coding?

Why the Answer Is Correct

Attestation is defined as the formal act of providing evidence, certification, or a third-party declaration that a specific condition or standard has been satisfied. In this scenario, the organization must prove to a customer that developers completed secure coding training, which is precisely what attestation provides. Community members correctly note that attestation involves documentation, certificates, or formal verification to demonstrate compliance. This aligns perfectly with third-party risk management and supply chain security requirements in SY0-701.

Why the Other Options Are Wrong

Assurance (A) refers to the ongoing confidence that a system or process meets security requirements, but it does not constitute the formal act of proving a specific claim to a customer. Contract (B) is a legally binding agreement between parties and does not inherently serve as proof of training completion. Due diligence (C) is the investigative process performed before entering an agreement to evaluate risks, not the act of certifying that a requirement has already been met. Comments consistently reinforce that only attestation fits the definition of formally proving a condition.

Community Comment Notes

All six community comments unanimously support answer D, with multiple users emphasizing that attestation involves formal certification or documentation. Comment [3] provides a particularly clear distinction between attestation and assurance, noting that assurance does not specifically involve formal proof. Comment [2] correctly eliminates due diligence by defining it as a pre-decision evaluation process. The strong consensus (100% votes for D) indicates this is a straightforward definition-based question with little ambiguity.