nerdexam
Isaca

CCAK · Question #54

As a developer building codes into a container in a DevSecOps environment, which of the following is the appropriate place(s) to perform security tests?

The correct answer is D. Within the CI/CD pipeline. In a DevSecOps environment, security is 'shifted left' and integrated throughout the entire software delivery lifecycle. The CI/CD pipeline is the correct answer because it represents the complete automated workflow - encompassing code commits, builds, tests, and deployments…

Cloud Security Auditing

Question

As a developer building codes into a container in a DevSecOps environment, which of the following is the appropriate place(s) to perform security tests?

Options

  • AWithin developer's laptop
  • BWithin the CI/CD server
  • CWithin version repositories
  • DWithin the CI/CD pipeline

How the community answered

(32 responses)
  • A
    6% (2)
  • B
    13% (4)
  • C
    6% (2)
  • D
    75% (24)

Explanation

In a DevSecOps environment, security is 'shifted left' and integrated throughout the entire software delivery lifecycle. The CI/CD pipeline is the correct answer because it represents the complete automated workflow - encompassing code commits, builds, tests, and deployments - and is where security controls such as SAST, DAST, SCA (software composition analysis), container image scanning, and secrets detection should be embedded. Testing only on a developer's laptop (A) or within version repositories (C) provides only partial coverage. The CI/CD server (B) is a component within the pipeline, but 'CI/CD pipeline' (D) is the broader and more accurate term that captures all integrated stages where security tests should occur.

Topics

#DevSecOps#CI/CD Pipeline#Security Testing#Container Security

Community Discussion

No community discussion yet for this question.

Full CCAK Practice