What security scanning tools should be integrated into a CI/CD pipeline? Explain the differences between SAST, DAST, and SCA, and when each is used.

Sample answer preview

A secure CI/CD pipeline integrates multiple types of security scanning to catch different categories of vulnerabilities at the appropriate stages. The three main types of application security testing are SAST, DAST, and SCA.