350-201 Question 284
Select 3A security team is collaborating with the development and operations teams to implement DevOps practices within their organization. One of their goals is to ensure that security is integrated throughout the CI/CD pipeline while maintaining rapid deployments. Which of the following practices best aligns with this goal?
- A
Integrating automated security testing tools into the CI/CD pipeline
- B
Performing manual security reviews only at the end of the development cycle
- C
Using Infrastructure as Code (IaC) to enforce consistent security configurations
- D
Deploying updates without any security validation to prioritize speed
- E
Conducting regular threat modeling during the development process
Show answer and explanation
Correct answers: A, C, E
Explanation
DevOps emphasizes collaboration, automation, and continuous integration of practices across development, operations, and security teams. By integrating automated security testing tools, leveraging Infrastructure as Code (IaC) for consistency, and incorporating regular threat modeling, organizations can ensure security is embedded throughout the CI/CD pipeline without sacrificing speed. These practices align with the principles of DevSecOps, which advocate for 'shifting security left' and integrating it into every phase of development.
- A. Correct.
Integrating automated security testing tools into the CI/CD pipeline ensures that security vulnerabilities are detected early in the development process, aligning with DevSecOps practices.
- B. Incorrect.
Performing manual security reviews only at the end of the development cycle is contrary to DevOps principles, as it delays detection of vulnerabilities and does not support continuous security integration.
- C. Correct.
Using Infrastructure as Code (IaC) helps enforce consistent and repeatable security configurations, ensuring that deployments are secure by default.
- D. Incorrect.
Deploying updates without any security validation undermines the security posture of the organization and contradicts the principles of DevSecOps.
- E. Correct.
Conducting regular threat modeling during the development process helps identify and mitigate potential security risks early, which is a core aspect of integrating security within DevOps practices.