350-201 Question 281
Select 3Your organization is implementing DevOps practices to improve its cybersecurity posture. As part of this effort, you are tasked with integrating security into the Continuous Integration/Continuous Deployment (CI/CD) pipeline for application development. Which approaches align with the principles of DevOps practices to enhance security in this context?
- A
Incorporate automated security testing tools within the CI/CD pipeline to identify vulnerabilities early.
- B
Perform security testing only during the final stages of application deployment to avoid delays in development.
- C
Use Infrastructure as Code (IaC) to automate and standardize secure infrastructure provisioning.
- D
Establish a siloed security review team that operates independently of the development and operations teams.
- E
Enable developers to integrate security practices into their workflows by providing training and secure coding guidelines.
Show answer and explanation
Correct answers: A, C, E
Explanation
DevOps practices aim to integrate security seamlessly into the development and operations processes. Correct approaches include leveraging automation (e.g., automated security testing and IaC), fostering collaboration, and empowering developers to adopt secure practices. These align with the principles of 'shift-left' security and continuous improvement, ensuring security is an integral part of the software development lifecycle.
- A. Correct.
Incorporating automated security testing tools in the CI/CD pipeline is a core DevOps practice that ensures vulnerabilities are identified and addressed early in the development lifecycle.
- B. Incorrect.
Delaying security testing until the final stages contradicts DevOps principles, which emphasize continuous feedback and early detection of issues.
- C. Correct.
Using Infrastructure as Code (IaC) aligns with DevOps principles by automating secure infrastructure provisioning and reducing the risk of misconfigurations.
- D. Incorrect.
A siloed security team contradicts the collaborative nature of DevOps, which promotes shared responsibility for security across teams.
- E. Correct.
Empowering developers with training and secure coding guidelines encourages them to take ownership of security, which is a key principle of DevSecOps.