CAS-005 · Question #42
Company A and Company D are merging Company A's compliance reports indicate branch protections are not in place. A security analyst needs to ensure that potential threats to the software development…
The correct answer is A. If developers are unable to promote to production. The analyst is tasked with addressing potential threats to the software development life cycle (SDLC) after identifying that branch protections are not in place in Company A's compliance reports. Branch protections are critical for secure code management, preventing…
Question
Company A and Company D are merging Company A's compliance reports indicate branch protections are not in place. A security analyst needs to ensure that potential threats to the software development life cycle are addressed. Which of the following should me analyst consider when completing this basic?
Options
- AIf developers are unable to promote to production
- BIf DAST code is being stored to a single code repository
- CIf DAST scans are routinely scheduled
- DIf role-based training is deployed
How the community answered
(29 responses)- A76% (22)
- B7% (2)
- C14% (4)
- D3% (1)
Explanation
The analyst is tasked with addressing potential threats to the software development life cycle (SDLC) after identifying that branch protections are not in place in Company A's compliance reports. Branch protections are critical for secure code management, preventing unauthorized or risky changes (e.g., direct pushes to main, unreviewed merges). Branch protections typically enforce peer review, code scanning, and other gates before code reaches production. If developers cannot promote to production directly, it ensures there’s a proper approval or CI/CD pipeline in place-a fundamental control to prevent insecure or unauthorized code changes. This aligns exactly with the compliance finding and the need to secure the SDLC.
Community Discussion
No community discussion yet for this question.