(Craig Kelly has been working as a software development team leader in an IT company over the past 8 years. His team is working on the development of…

Dynamic Application Security Testing (DAST) and fuzz testing are techniques that require a running application to analyze. They interact with the application from the outside, simulating attacks and providing unexpected inputs to identify vulnerabilities at runtime. This type of analysis is performed during the "Test-time" phase of the DevSecOps pipeline. In this phase, the application has been successfully built and deployed to a dedicated testing or staging environment, making it accessible for these dynamic, black-box testing tools to execute their checks before the application is promoted to production.

A: Commit-time checks are fast, static analyses (e.g., linting) performed on the source code itself, not a running application.

B: Build-time checks occur during code compilation and packaging, typically involving dependency scanning or deeper static analysis.

C: Deploy-time checks focus on the security of the target infrastructure and configuration, not the application's runtime behavior.

OWASP. (n.d.). "OWASP DevSecOps Guideline." OWASP Foundation. Section: "Phase 4: Test". Retrieved from https://owasp.org/www-project-devsecops-guideline/latest/04-Pipeline-Phase-Implementation/04-Phase-Test. (This guideline explicitly places DAST within the Test phase of the CI/CD pipeline).

Suresh, M., & Chow, J. (2020). A DevSecOps Reference Architecture. Software Engineering Institute, Carnegie Mellon University. CMU/SEI-2020-TN-011. Page 11, Figure 4. (This reference architecture diagram shows DAST occurring in the "Test/QA" stage of the DevSecOps pipeline).