As part of an IoT project, an organization is developing an edge application that will run on a gateway to securely transmit sensor information it receives into an IoT cloud. Based on the Agile…

Question

Options

• APerform automated code reviews prior to deployment.
• BImplement auto-provisioning security inspection for the code.
• CPerform on-going penetration testing on the system.
• DPerform a GAP analysis on current security activities and policies.
• ETrain members of the team in a secure software development lifecycle methodology such as

• A
  5% (1)
• B
  5% (1)
• C
  14% (3)
• D
  76% (16)

Explanation

Performing a GAP analysis (D) identifies where current security practices fall short against desired policies, giving the team a clear baseline to build a secure CI/CD pipeline from. Training team members in a secure SDLC methodology (E) is equally foundational because security must be embedded in developers' habits from the start - if the team doesn't know how to write or review secure code, no pipeline tooling fully compensates.

Why the distractors are wrong:

• A (automated code reviews): Useful in a CI/CD pipeline, but the question targets SDLC-level improvements - automated scanning is a tool, not an SDLC methodology improvement.
• B (auto-provisioning security inspection): Not a recognized or standard security practice; the term is vague and doesn't map to any established methodology.
• C (ongoing penetration testing): Pen testing is typically a post-deployment operational activity, not part of the implementation and testing phases of the SDLC.

Memory tip: Think "Foundation before Feature" - before writing a single secure line of code, you must Know your gaps (GAP analysis) and Grow your team (training). D and E are the two things you do before the pipeline does anything; A, B, and C are things the pipeline does.

No community discussion yet for this question.