350-201 Question 85
Select 3Your organization is implementing a DevSecOps pipeline for application development. Security testing has been identified as a critical component to be integrated into the Continuous Integration/Continuous Deployment (CI/CD) process. Which of the following are recommended practices to ensure effective security within the DevSecOps pipeline?
- A
Implement automated static application security testing (SAST) during the build phase.
- B
Run dynamic application security testing (DAST) only after the application is deployed to production.
- C
Incorporate security checkpoints as manual approval steps in every phase of the pipeline.
- D
Enable container image scanning for vulnerabilities before deployment.
- E
Ensure developers have access to secure coding training and guidelines.
Show answer and explanation
Correct answers: A, D, E
Explanation
DevSecOps emphasizes integrating security into every phase of the development lifecycle. Practices like automated SAST, container image scanning, and developer training align with the principles of automation, early detection, and proactive mitigation. These practices help enhance security within the pipeline without compromising the speed and agility of DevSecOps. On the other hand, relying solely on post-deployment testing or excessive manual checkpoints contradicts the goals of DevSecOps and may introduce inefficiencies.
- A. Correct.
Implementing automated SAST during the build phase helps identify vulnerabilities in the source code early in the development process, reducing the cost and effort of fixing issues later.
- B. Incorrect.
Running DAST only after deployment to production is not recommended as it delays the discovery of runtime vulnerabilities, potentially exposing the application to risks during deployment.
- C. Incorrect.
While incorporating security checkpoints is important, manual approval steps in every phase can significantly slow down the pipeline and contradict the automation principles of DevSecOps.
- D. Correct.
Container image scanning ensures that vulnerabilities within containers are detected and mitigated before deployment, which is a critical practice in securing modern cloud-native applications.
- E. Correct.
Providing developers with secure coding training and guidelines equips them with the knowledge to write secure code, which is a proactive approach to reducing vulnerabilities.