CCAK · Question #54
As a developer building codes into a container in a DevSecOps environment, which of the following is the appropriate place(s) to perform security tests?
The correct answer is D. Within the CI/CD pipeline. In a DevSecOps environment, security is 'shifted left' and integrated throughout the entire software delivery lifecycle. The CI/CD pipeline is the correct answer because it represents the complete automated workflow - encompassing code commits, builds, tests, and deployments…
Question
As a developer building codes into a container in a DevSecOps environment, which of the following is the appropriate place(s) to perform security tests?
Options
- AWithin developer's laptop
- BWithin the CI/CD server
- CWithin version repositories
- DWithin the CI/CD pipeline
How the community answered
(32 responses)- A6% (2)
- B13% (4)
- C6% (2)
- D75% (24)
Explanation
In a DevSecOps environment, security is 'shifted left' and integrated throughout the entire software delivery lifecycle. The CI/CD pipeline is the correct answer because it represents the complete automated workflow - encompassing code commits, builds, tests, and deployments - and is where security controls such as SAST, DAST, SCA (software composition analysis), container image scanning, and secrets detection should be embedded. Testing only on a developer's laptop (A) or within version repositories (C) provides only partial coverage. The CI/CD server (B) is a component within the pipeline, but 'CI/CD pipeline' (D) is the broader and more accurate term that captures all integrated stages where security tests should occur.
Topics
Community Discussion
No community discussion yet for this question.