350-201 Question 86
Select 2A financial services company is migrating its infrastructure to a DevSecOps model to enhance security throughout its software development lifecycle (SDLC). As a cybersecurity engineer, you are tasked with recommending best practices for implementing security in this model. Which two recommendations should you provide to integrate security effectively into the DevSecOps process?
- A
Implement automated security testing tools as part of the CI/CD pipeline to identify vulnerabilities early.
- B
Delay vulnerability scanning until after the application is deployed to production to minimize development delays.
- C
Adopt Infrastructure as Code (IaC) practices to enforce consistent security configurations across environments.
- D
Perform manual code reviews exclusively to ensure security instead of relying on automated tools.
- E
Integrate runtime application self-protection (RASP) tools to monitor and block attacks in real time during production.
Show answer and explanation
Correct answers: A, C
Explanation
DevSecOps aims to integrate security into every phase of the software development lifecycle. Automating security tests in the CI/CD pipeline ensures vulnerabilities are caught early, while adopting Infrastructure as Code (IaC) helps maintain secure and consistent configurations across environments. Together, these practices align with the principles of DevSecOps by embedding security into development workflows, enhancing both efficiency and security posture.
- A. Correct.
Correct. Automated security testing tools in the CI/CD pipeline help identify vulnerabilities early in the development process, reducing the cost and effort of fixing them later.
- B. Incorrect.
Incorrect. Delaying vulnerability scanning until production increases the risk of deploying insecure applications and can lead to higher remediation costs.
- C. Correct.
Correct. Infrastructure as Code (IaC) ensures that consistent security configurations can be enforced across development, test, and production environments, reducing configuration drift and vulnerabilities.
- D. Incorrect.
Incorrect. While manual code reviews are useful, relying exclusively on them is inefficient and prone to human error. Automated tools should complement manual efforts for better coverage.
- E. Incorrect.
Incorrect. Although RASP tools are valuable for runtime protection, they are not a substitute for integrating security earlier in the SDLC, which is a primary goal of DevSecOps.