CompTIA SecurityX (CAS-005) CAS-005 — Question 382

A software analyst is conducting a forensic investigation. The analyst needs to differentiate between approved software components and those used within an application If used as part of the CI/CD pipeline, which of the following would most effectively help the analyst do this?