350-201 Question 279
Select 3A security analyst is tasked with identifying vulnerable stages in the CI/CD pipeline of a company’s software development process. The analyst must also recommend components that enhance the security posture during the pipeline execution. Which of the following are key components of a CI/CD pipeline that the analyst should focus on for securing the process?
- A
Source code repository
- B
Build automation tools
- C
Monitoring and logging systems
- D
Container orchestration platforms
- E
Static code analysis tools
Show answer and explanation
Correct answers: A, B, E
Explanation
The CI/CD pipeline consists of various stages, such as source code management, build automation, testing, and deployment. Securing the source code repository ensures that the foundation of the pipeline is protected. Build automation tools are central to the pipeline's execution, requiring proper security configurations. Static code analysis tools help detect vulnerabilities early in the pipeline, enhancing the overall security posture. While monitoring/logging systems and container orchestration platforms are important in broader contexts, they are not direct components of the CI/CD pipeline.
- A. Correct.
Source code repositories (e.g., Git) are critical components of a CI/CD pipeline. They must be secured to prevent unauthorized access or tampering with the code.
- B. Correct.
Build automation tools (e.g., Jenkins, GitLab CI/CD) are integral to the CI/CD pipeline. They should be configured securely to prevent malicious code execution or unauthorized builds.
- C. Incorrect.
While monitoring and logging systems are important for overall security and post-incident analysis, they are not direct components of the CI/CD pipeline itself.
- D. Incorrect.
Container orchestration platforms (e.g., Kubernetes) help manage containerized applications but are not direct components of the CI/CD pipeline. They come into play after deployment.
- E. Correct.
Static code analysis tools are essential for identifying vulnerabilities in code during the CI/CD process, making them a critical security component.