DOP-C02 Question 13
Select 3Your organization has adopted a DevOps approach and is moving toward implementing a CI/CD pipeline to automate the software development lifecycle. As part of this effort, you are tasked with ensuring that code quality and security are consistently reviewed during the development and deployment processes. Which of the following actions would best align with incorporating these reviews into the software development lifecycle in an automated CI/CD pipeline?
- A
Integrate static code analysis tools into the build stage of the pipeline to detect code quality and security issues.
- B
Perform manual code reviews after every deployment to production to identify any potential vulnerabilities.
- C
Include automated security testing as part of the pipeline's testing stage to identify vulnerabilities before production deployment.
- D
Set up automated approval workflows in the pipeline to ensure all builds pass predefined security checks before deployment.
- E
Rely solely on post-deployment monitoring in production to identify and fix security vulnerabilities.
Show answer and explanation
Correct answers: A, C, D
Explanation
To effectively integrate code quality and security reviews into the software development lifecycle using a CI/CD pipeline, it is essential to adopt proactive and automated measures. This includes static code analysis during the build stage, automated security testing during the testing stage, and automated approval workflows to enforce security compliance before deployment. These actions align with DevOps best practices and the 'shift-left' strategy, ensuring issues are addressed early in the pipeline. Solely relying on manual reviews or post-deployment monitoring is inefficient and does not fully leverage the benefits of automation in CI/CD pipelines.
- A. Correct.
Integrating static code analysis tools into the build stage helps detect code quality and security issues early in the development process, aligning with the 'shift-left' strategy in DevOps.
- B. Incorrect.
While manual code reviews are valuable, performing them after deployment to production is not an efficient or proactive approach to ensuring code quality and security in a CI/CD pipeline.
- C. Correct.
Automated security testing during the testing stage ensures that vulnerabilities are identified prior to deployment, reducing the risk of introducing insecure code into production.
- D. Correct.
Automated approval workflows that enforce security checks help ensure that only compliant builds are deployed, supporting the automation and security goals of the CI/CD pipeline.
- E. Incorrect.
Relying solely on post-deployment monitoring is reactive and does not align with the proactive security and quality measures expected in a CI/CD pipeline.