Which DevSecOps practice helps reduce vulnerabilities introduced through external open-source components?

Software composition analysis inventories third-party and open-source packages, identifies their versions and dependencies, and compares them with vulnerability and licensing information. Running SCA during the build stage shifts dependency checking left, allowing a vulnerable component to fail policy before the application is released. Therefore, B directly addresses the risk in the question. The joint CISA and security-agency guidance on managing open-source software and software bills of materials explains that SCA tools analyze application dependencies for vulnerabilities and open-source license violations. Static and dynamic routing choices affect packet forwarding, while round-robin DNS affects service distribution. None of those networking mechanisms examines software libraries, transitive dependencies, known CVEs, or component licenses within a DevSecOps pipeline.

================