Certified Information Systems Security Professional CISSP · Free Practice Question Medium
Question 47
ThorTeaches.com has recently implemented a CI/CD (Continuous Integration/Continuous Deployment) pipeline for their software development process. However, security concerns have been raised about the potential risks of automatically deploying code without thorough security testing. As the IT security manager, it is your job to initiate a plan to ensure the security of the CI/CD pipeline. What is the best approach to ensure the security of the CI/CD pipeline?
- A Only allowing code deployments from trusted developers
- B Adding a security layer to the pipeline that automatically scans for vulnerabilities before deployment
- C Implementing manual security testing at each stage of the pipeline
- D Disabling the automatic deployment feature and requiring manual approval for each deployment
Reveal correct answer
Correct answer: B
Explanation
The correct answer: Adding a security layer to the pipeline that automatically scans for vulnerabilities before deployment: This option is the most appropriate for ensuring the security of the CI/CD (Continuous Integration/Continuous Deployment) pipeline. It means integrating security tools into the pipeline that can automatically analyze the code for any security vulnerabilities at various stages before the code is deployed. This approach is commonly referred to as DevSecOps, where security is embedded into the DevOps process. This can significantly reduce the risk of deploying insecure code, as potential security issues can be identified and fixed before deployment. The automated nature of this approach ensures that security checks are consistently applied, reducing the chance of human error and enabling a fast and efficient deployment process that is also secure. The incorrect answers: Implementing manual security testing at each stage of the pipeline: While manual security testing can identify issues that automated tools might miss, it is not efficient or practical to manually test at every stage of the pipeline, especially in a CI/CD environment where the aim is to automate as much as possible for rapid deployment. It's also prone to human error and cannot keep up with the volume of code changes in a typical CI/CD pipeline. Only allowing code deployments from trusted developers: This option doesn't adequately secure the CI/CD pipeline. Even trusted developers can unintentionally introduce security vulnerabilities into the code. Security is not just about who writes or deploys the code but also about the quality and security of the code itself. Relying only on trust does not guarantee a secure pipeline. Disabling the automatic deployment feature and requiring manual approval for each deployment: This approach goes against the principles of CI/CD, which is to automate the software delivery process and make it more efficient. While it adds a layer of control, it significantly slows down the process and is not scalable, particularly for larger projects with frequent deployments. Manual approvals are also subject to human error or oversight, so they do not inherently ensure the security of the deployments.Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
You must be logged in to post a comment.
