A security engineer must resolve a vulnerability in a deprecated version of Python for a custom-developed flight simulation application that is monitored and controlled remotely. The source code is proprietary and built with Python functions running on the Ubuntu operating system. Version control is not enabled for the application in development or production. However, the application must remain online in the production environment using built-in features. Which of the following solutions best reduces the attack surface of these issues and meets the outlined requirements?
Correct Answer: A
Code-signing within the CI/CD pipeline ensures that only verified and signed code is deployed, mitigating the risk of supply chain attacks. Updating Python with aptitude and updating modules with pip ensures vulnerabilities are patched. Deploying the solution to production after testing maintains application availability while securing the development lifecycle.
Branch protection (B) applies only to version-controlled environments, which is not the case here.
NFS network share (C) does not address the deprecated Python vulnerability.
Version designation (D) does not eliminate security risks from outdated dependencies.