CAS-005 · Question #185
A company updates its cloud-based services by saving infrastructure code in a remote repository. The code is automatically deployed into the development environment every time the code is saved to…
The correct answer is B. Pre-commit code linting D. Automated regression testing. To reduce deployment failures caused by minor code issues and security check failures, developers should use pre-commit code linting to catch errors early and automated regression testing to ensure new code doesn't break existing functionality.
Question
A company updates its cloud-based services by saving infrastructure code in a remote repository. The code is automatically deployed into the development environment every time the code is saved to the repository. The developers express concern that the deployment often fails, citing minor code issues and occasional security control check failures in the development environment. Which of the following should a security engineer recommend to reduce the deployment failures? (Choose two.)
Options
- ASoftware composition analysis
- BPre-commit code linting
- CRepository branch protection
- DAutomated regression testing
- ECode submit authorization workflow
- FPipeline compliance scanning
How the community answered
(19 responses)- A5% (1)
- B74% (14)
- C11% (2)
- F11% (2)
Why each option
To reduce deployment failures caused by minor code issues and security check failures, developers should use pre-commit code linting to catch errors early and automated regression testing to ensure new code doesn't break existing functionality.
Software composition analysis primarily focuses on identifying vulnerabilities and licensing issues in third-party and open-source components, which is less directly related to preventing 'minor code issues' or general deployment failures from new code.
Pre-commit code linting enables developers to identify and fix minor code issues, stylistic errors, and potential bugs locally before code is committed to the repository, thereby preventing these issues from triggering deployment failures in the development environment.
Repository branch protection controls merging into critical branches, which is a good practice for overall code quality, but it does not address the immediate prevention of individual 'minor code issues' or provide functional validation like testing before deployment.
Automated regression testing ensures that new code changes do not adversely affect existing functionality or introduce new defects, helping to catch issues that could lead to deployment failures, including those related to security control checks, before they reach the deployment stage.
A code submit authorization workflow manages who can submit code and under what conditions, but it doesn't directly prevent technical 'minor code issues' or validate functionality that causes deployment failures.
Pipeline compliance scanning occurs during the CI/CD pipeline and helps identify security policy violations, but the goal is to reduce failures by catching issues before they enter the pipeline or early in it, rather not just identifying them during a scan that then leads to failure.
Concept tested: Shift-left security and CI/CD quality gates
Source: https://learn.microsoft.com/en-us/azure/devops/develop/devsecops-continuous-security?view=azure-devops
Community Discussion
No community discussion yet for this question.