Which of the following would be the MOST critical finding of an application security and DevOps audit?

Question

Options

• AThe organization is not using a unified framework to integrate cloud compliance with regulatory
• BApplication architecture and configurations did not consider security measures.
• COutsourced cloud service interruption, breach or loss of data stored at the cloud service provider.
• DCertifications with global security standards specific to cloud are not reviewed and the impact of

• A
  15% (9)
• B
  49% (29)
• C
  7% (4)
• D
  29% (17)

Explanation

Application architecture that ignores security from the start (B) is the most critical finding because it represents a foundational failure - security gaps baked into the architecture propagate through every layer of the system and are exponentially more expensive to remediate post-deployment than at design time. A DevOps audit prioritizes findings that expose the root cause of risk, and insecure architecture is that root cause.

Why the distractors fall short:

• A (no unified compliance framework) is a governance process gap - important, but it describes how compliance is managed, not whether the application itself is secure.
• C (outsourced cloud service risk) describes a third-party/vendor risk scenario, which is largely outside the organization's direct control and is mitigated through contracts and SLAs, not architectural decisions.
• D (certifications not reviewed) is a due-diligence oversight - a documentation/review gap, not a direct indicator of active vulnerability in the application.

Memory tip: In security audits, think "root vs. branch." Options A, C, and D are branch-level issues (process, vendor, paperwork). Option B is the root - if architecture is insecure, everything built on it inherits that weakness. When the exam asks for the most critical finding, follow the root.

No community discussion yet for this question.