200-201 Question 38
Single answerA security operations center (SOC) analyst is reviewing the development pipeline of a company that recently adopted DevSecOps practices. The analyst notices that developers are manually uploading application builds to a testing server, bypassing automated security checks. Which action aligns with the core principles of DevSecOps to address this issue?
- A
Implement automated CI/CD pipelines that include security testing stages.
- B
Require developers to manually document all security checks performed during testing.
- C
Enforce strict network isolation between development and testing environments.
- D
Schedule periodic security audits to verify compliance with security standards.
Show answer and explanation
Correct answer: A
Explanation
DevSecOps emphasizes integrating security into every stage of the development lifecycle through automation and collaboration. Automating CI/CD pipelines with built-in security testing ensures consistent application of security measures and prevents manual bypassing of critical checks.
- A. Correct.
This option aligns with DevSecOps principles by integrating automated security checks into the CI/CD pipeline, ensuring consistent and efficient security testing.
- B. Incorrect.
While documentation is important, requiring manual documentation does not align with the automation and efficiency goals of DevSecOps.
- C. Incorrect.
Although network isolation is a good security practice, it does not address the issue of bypassing automated security checks in the DevSecOps pipeline.
- D. Incorrect.
Periodic audits are useful for compliance but do not provide the continuous security integration required by DevSecOps principles.