Which of the following could be considered the MOST significant security challenge when adopting DevOps practices compared to a more traditional control framework?

While SLA management for patch releases is operationally important, it is a process alignment challenge rather than a fundamental security control conflict introduced specifically by DevOps adoption.

In traditional control frameworks, segregation of duties ensures that no single individual can control all phases of a critical process, reducing fraud and error risk. DevOps practices intentionally blur the lines between developers, operations staff, and sometimes security personnel - giving individuals broad access to build, deploy, and manage systems - directly undermining SoD principles. This creates a significant compliance and security challenge, especially in regulated industries where SoD is mandated by frameworks like SOX, PCI-DSS, or ISO 27001.

Standardizing logging, alerting, and security metrics is a technical implementation challenge that DevOps practices can actually improve through infrastructure-as-code and automation, making it less of a unique security conflict.

The availability of security teams for end-stage manual audits is a concern in traditional waterfall models, but DevOps addresses this by shifting security left - integrating security earlier in the pipeline - rather than introducing a new challenge.