The correct answer is: Include both automated vulnerability scans and hands on penetration testing in a comprehensive security testing plan

This option is correct because automated vulnerability scanning and manual penetration testing serve complementary purposes. Automated scans provide broad and repeatable coverage that is suited to continuous integration and frequent checks. Human led penetration testing finds complex logic issues chained exploits and business logic problems that automated tools often miss.

A comprehensive testing plan should include both approaches and apply them across the development lifecycle. Scanning can run continuously in development and CI pipelines and manual tests can be scheduled against staging and production with clear rules of engagement to reduce risk.

Google Cloud Security Command Center is an important tool for visibility asset inventory and managing security findings but it is not by itself a testing strategy. It helps centralize and prioritize results that come from scanners and tests but it does not replace performing scans and penetration tests.

Perform security testing only after deployment in the live environment is incorrect because waiting until production delays discovery of vulnerabilities and increases risk. Security testing should start early in development and continue through staging and production with appropriate controls.

Focus security testing solely on the application tier and ignore network and host layers is incorrect because vulnerabilities exist at multiple layers and misconfigurations at the network or host level can be exploited. A thorough plan covers application network host and cloud configuration testing.

Full AWS Practitioner Certification Question