An IS auditor is assessing an organization's DevSecOps approach. Which of the following BEST indicates a proactive approach to identifying vulnerabilities?

The correct answer is A. Integration of automated security testing tools into the continuous integration/continuous delivery. Embedding automated security tests (such as SAST, DAST, or software composition analysis) directly into the CI/CD pipeline means vulnerabilities are detected as code is written and built, shifting security left and enabling proactive remediation before deployment.

Submitted by sofia.br· Apr 18, 2026Information Systems Acquisition, Development, and Implementation

Question

An IS auditor is assessing an organization’s DevSecOps approach. Which of the following BEST indicates a proactive approach to identifying vulnerabilities?

Options

AIntegration of automated security testing tools into the continuous integration/continuous delivery
BOpen-source dependency checks within continuous integration/continuous delivery (CI/CD)
CUse of the most current development frameworks and libraries
DPost-implementation vulnerability scans on application deployments

How the community answered

(43 responses)

A
77% (33)
B
14% (6)
C
2% (1)
D
7% (3)

Explanation

Embedding automated security tests (such as SAST, DAST, or software composition analysis) directly into the CI/CD pipeline means vulnerabilities are detected as code is written and built, shifting security left and enabling proactive remediation before deployment.

Topics

#DevSecOps#Automated Security Testing#CI/CD Security#Vulnerability Identification

Community Discussion

No community discussion yet for this question.

Full CISA Practice