A software company is adopting a SecDevOps approach to improve the security integration in its development cycle for a new cloud-based application suite. The suite includes customer-facing apps with…

Question

Options

• AIntegrate real-time threat monitoring and incident response mechanisms, and enforce role-based access control for development and production environments.
• BConduct monthly manual security reviews for all code, and limit developer access to production environments to senior staff only.
• CApply manual code review for every push to the repository, and enforce a biannual external security audit of the entire application suite.
• DEmbed automated security scans and compliance checks in the CI/CD pipeline, and use container orchestration tools for consistent deployment.

• A
  10% (6)
• B
  2% (1)
• C
  3% (2)
• D
  84% (49)

Explanation

Embedding automated security scans and compliance checks directly into the CI/CD pipeline is the hallmark of SecDevOps - it shifts security left without slowing deployment, and container orchestration ensures environments are consistent and reproducible across dev, staging, and production. Option A describes good security practices (threat monitoring, RBAC) but focuses on operational/runtime controls rather than integrating security into the development pipeline itself, which is the core SecDevOps principle. Options B and C both rely on manual processes (monthly reviews, biannual audits, manual code review per push) that fundamentally conflict with a "fast-paced deployment cycle" - manual gates become bottlenecks at CI/CD speed. The key memory tip: SecDevOps = Automate + Integrate - if the answer involves manual reviews or periodic audits, it's incompatible with continuous deployment; the correct answer always embeds security tooling in the pipeline, not alongside it.

No community discussion yet for this question.