350-201 Question 278
Select 3A cybersecurity team is implementing a CI/CD pipeline to automate the deployment of a new web application. They want to integrate security checks that identify vulnerabilities early in the development process and ensure secure configurations during deployment. Which of the following components should they include in their CI/CD pipeline to meet these objectives?
- A
Static Application Security Testing (SAST)
- B
Dynamic Application Security Testing (DAST)
- C
Infrastructure as Code (IaC) scanning
- D
Load testing for performance optimization
- E
Code review by a manual reviewer
Show answer and explanation
Correct answers: A, B, C
Explanation
To secure a CI/CD pipeline, integrating security tools such as SAST, DAST, and IaC scanning is critical. SAST identifies vulnerabilities at the code level, DAST ensures runtime security, and IaC scanning secures deployment configurations. These automated tools enhance the pipeline's ability to detect and mitigate security risks early and efficiently.
- A. Correct.
Static Application Security Testing (SAST) is a critical component of a CI/CD pipeline. It analyzes source code for vulnerabilities early in the development phase, ensuring security issues are identified before deployment.
- B. Correct.
Dynamic Application Security Testing (DAST) evaluates the application in a running state to identify security vulnerabilities. It's essential for detecting runtime vulnerabilities and misconfigurations in a CI/CD pipeline.
- C. Correct.
Infrastructure as Code (IaC) scanning ensures that the configurations used for infrastructure deployment are secure and compliant with best practices, reducing the risk of exposing vulnerabilities in deployment environments.
- D. Incorrect.
Load testing is focused on performance optimization and not directly related to identifying security vulnerabilities or enforcing secure configurations in the context of CI/CD pipelines.
- E. Incorrect.
Manual code reviews are valuable but are not typically an automated component of a CI/CD pipeline. They are a separate process and do not align with the automated nature of CI/CD pipelines.