Which of the following would be of GREATEST concern to an is auditor reviewing continuous integration/continuous deployment (CI/CD) practices?

The correct answer is D. Critical security test failures within the pipeline do not stop production deployment. The greatest concern would be if critical security test failures within the CI/CD pipeline do not prevent deployment to production. This indicates that vulnerabilities or significant security issues could be introduced into production environments, potentially exposing the system

Submitted by femi9· Apr 18, 2026Information Systems Acquisition, Development, and Implementation

Question

Options

ADynamic application security testing (DAST) is not performed for every build
BIf all pipeline tests pass, changes are allowed to be deployed into production without manual
CThe time between deployments has varied from four hours to two weeks
DCritical security test failures within the pipeline do not stop production deployment

How the community answered

(44 responses)

A
5% (2)
B
23% (10)
C
11% (5)
D
61% (27)

Explanation

The greatest concern would be if critical security test failures within the CI/CD pipeline do not prevent deployment to production. This indicates that vulnerabilities or significant security issues could be introduced into production environments, potentially exposing the system to risks. Ensuring that critical security tests act as blocking mechanisms is essential for maintaining a secure CI/CD process.

Topics

#CI/CD Security#SDLC Controls#Application Security Testing#Deployment Pipeline

Community Discussion

No community discussion yet for this question.

Full CISA Practice