350-201 Question 87
Select 3Your organization is adopting a DevSecOps approach to integrate security into the software development lifecycle. As a cybersecurity engineer, you are tasked with recommending practices to enhance security within the CI/CD pipeline. Which of the following recommendations align with DevSecOps principles?
- A
Implement automated security testing as part of the CI/CD pipeline.
- B
Perform manual security assessments only after deployment to production.
- C
Use Infrastructure as Code (IaC) to enforce security baselines.
- D
Ensure security tools are integrated early in the development lifecycle.
- E
Restrict collaboration between development, operations, and security teams to minimize risks.
Show answer and explanation
Correct answers: A, C, D
Explanation
DevSecOps emphasizes integrating security throughout the software development lifecycle, promoting automation, collaboration across teams, and early detection of vulnerabilities. Automated security testing, IaC for security baselines, and early integration of security tools are fundamental practices. Delayed manual assessments and restricting collaboration go against these principles.
- A. Correct.
Automated security testing is a key DevSecOps practice to continuously identify vulnerabilities as part of the CI/CD process.
- B. Incorrect.
Manual security assessments after deployment do not align with DevSecOps principles, as they delay security feedback and introduce risks.
- C. Correct.
Using Infrastructure as Code (IaC) to enforce security baselines improves consistency and ensures secure configurations are applied automatically.
- D. Correct.
Integrating security tools early in the development lifecycle aligns with the 'shift-left' principle of DevSecOps, enabling faster detection and remediation of vulnerabilities.
- E. Incorrect.
Restricting collaboration contradicts core DevSecOps principles, which emphasize cross-team communication and shared responsibility for security.