350-201 Question 88
Select 3A cybersecurity team is integrating DevSecOps principles into their CI/CD pipeline to enhance security. Which of the following actions align with DevSecOps recommendations for secure application development?
- A
Automating security testing as part of the CI/CD pipeline
- B
Conducting manual code reviews after every deployment
- C
Implementing role-based access control (RBAC) for CI/CD tools
- D
Encrypting all data in transit and at rest
- E
Delaying security scans until the production phase
Show answer and explanation
Correct answers: A, C, D
Explanation
DevSecOps integrates security into every step of the development lifecycle. Automating security testing, enforcing least-privilege access via RBAC, and encrypting data are key recommendations to proactively secure applications. Delaying security checks or relying solely on manual reviews undermines the core DevSecOps principle of continuous and automated security integration.
- A. Correct.
Automating security testing aligns with DevSecOps principles as it ensures security is continuously verified during development and deployment stages.
- B. Incorrect.
While manual code reviews can be valuable, relying solely on them after deployment contradicts the proactive and automation-focused nature of DevSecOps.
- C. Correct.
Implementing RBAC ensures that only authorized personnel have access to sensitive CI/CD tools, which is a critical security measure in DevSecOps.
- D. Correct.
Encrypting data in transit and at rest is a fundamental security best practice and is essential to DevSecOps strategies to protect sensitive information.
- E. Incorrect.
Delaying security scans until the production phase contradicts DevSecOps principles, which emphasize 'shift-left' practices, embedding security early in the development lifecycle.