Your Azure DevOps build pipeline depends on about fifty open-source libraries. You need to scan these libraries for common security issues. Which approach should you take?

The correct approach is to create a build task that uses the WhiteSource Bolt service. WhiteSource Bolt is a free, lightweight open-source security and license compliance scanner specifically designed to integrate into Azure DevOps pipelines. It analyzes your open-source components during the build process to identify known vulnerabilities and license issues, which is exactly what's needed for scanning the fifty open-source libraries. Using a deployment task for WhiteSource Bolt is incorrect because security scanning of dependencies should ideally happen earlier in the pipeline (during build) to catch issues before deployment. Chef is a configuration management tool primarily used for automating infrastructure provisioning and software deployment, not for scanning open-source libraries for security vulnerabilities, making both Chef options incorrect.