Question 21

Explanation

The correct answer: By incorporating security checks into the CI/CD pipeline, you ensure that security is considered at every stage of the development process - from coding and building to testing and deployment. This allows for early detection and mitigation of security risks, making it the best approach to integrate security into the DevOps model, transitioning effectively to a DevSecOps model. This also enables a shift-left approach, addressing security issues earlier in the lifecycle where they are typically easier and less costly to resolve. The incorrect answers: Conducting periodic security audits after deployment is an important part of maintaining a secure system, but it isn't the most efficient way to integrate security into a DevOps model. This approach tends to be reactive rather than proactive, as it identifies vulnerabilities after they've been introduced into the production environment, potentially exposing the system to security risks. Although training the development team on secure coding practices is a beneficial practice, it isn't the most effective way to integrate security into the existing DevOps model. It does help developers write more secure code, but it doesn't ensure that security is automatically and consistently addressed throughout all stages of the software development lifecycle. Having a dedicated security team is beneficial, but it doesn't necessarily align with the principles of DevSecOps, which aim to incorporate security into all aspects of the development process, rather than siloing it. This approach may also lead to communication gaps between the security team and other departments.