Answer-first summary for fast verification
Answer: Adopt a 'Security as Code' approach, integrating automated security testing and compliance checks into the CI/CD pipeline, and foster collaboration between security, development, and operations teams from the outset.
The 'Security as Code' approach (Option C) is the most effective strategy for integrating security into the DevOps process without compromising on speed or efficiency. By automating security testing and compliance checks within the CI/CD pipeline, security becomes a shared responsibility across teams, enabling early detection and remediation of vulnerabilities. This approach aligns with the principles of DevOps and meets the organization's need for compliance and data protection. Option A and B are inadequate as they either delay security integration or create silos, both of which can lead to security gaps and compliance issues. Option D is overly restrictive and contradicts the DevOps ethos of collaboration and automation, potentially hindering the organization's agility.
Author: LeetQuiz Editorial Team
Ultimate access to all questions.
Your organization is transitioning to a DevOps model for software development and deployment, aiming to enhance agility and efficiency. As the Cybersecurity Architect, you are tasked with embedding security seamlessly into the DevOps lifecycle to mitigate risks without hindering the DevOps speed and automation benefits. The organization operates in a highly regulated industry, requiring compliance with strict data protection standards. Given these constraints, which of the following strategies BEST ensures security is integrated throughout the DevOps process while maintaining compliance and operational efficiency? (Choose one)
A
Delay all security considerations until the final stages of development to avoid slowing down the initial phases, focusing solely on compliance checks before deployment.
B
Implement a separate, parallel security review process that runs independently of the DevOps pipeline to ensure thorough security assessments without affecting development timelines.
C
Adopt a 'Security as Code' approach, integrating automated security testing and compliance checks into the CI/CD pipeline, and foster collaboration between security, development, and operations teams from the outset.
D
Limit the adoption of DevOps tools and practices to only those that have been pre-approved by the security team, significantly reducing the risk of introducing vulnerabilities.
No comments yet.