350-201 Question 280
Select 3A security analyst is tasked with integrating security checks into the CI/CD pipeline for a development team. The goal is to ensure that vulnerabilities are identified and addressed before code is deployed to production. Which components of a CI/CD pipeline should the analyst focus on to implement these security measures?
- A
Source code repository
- B
Build automation
- C
Static Application Security Testing (SAST)
- D
Deployment automation
- E
Continuous monitoring tools
Show answer and explanation
Correct answers: A, C, E
Explanation
To secure a CI/CD pipeline, it is necessary to focus on components where vulnerabilities can be introduced or detected. The source code repository is a critical point for integrating checks to prevent insecure code from being committed. SAST tools specifically analyze the code for vulnerabilities during the development stages. Continuous monitoring tools extend security into the production environment, ensuring that threats are identified and mitigated post-deployment.
- A. Correct.
The source code repository is where code changes are stored, and it is crucial to integrate security checks here, such as scanning for secrets or malicious code commits.
- B. Incorrect.
While build automation ensures that code is compiled and packaged efficiently, it is not directly responsible for security checks.
- C. Correct.
Static Application Security Testing (SAST) tools are specifically designed to analyze code for vulnerabilities during the development process, making them essential for securing the pipeline.
- D. Incorrect.
Deployment automation focuses on releasing code to production, but it does not inherently perform security checks.
- E. Correct.
Continuous monitoring tools help detect anomalies and vulnerabilities in production environments, ensuring security beyond deployment.