Certified Cloud Security Professional (CCSP)Cloud Application SecurityHard
A team is developing a critical cloud application that requires high availability and resilience. They are implementing a DevSecOps pipeline and want to ensure that security is 'baked in' from the start. To achieve continuous security validation and rapid feedback on potential misconfigurations or vulnerabilities in deployed infrastructure, which DevSecOps practice should be prioritized?
- AManual security reviews and penetration testing conducted quarterly.
- BAdopting a 'security champion' model within the development teams.
- CIntegrating security configuration baselines and continuous compliance scanning.
- DUtilizing a centralized security information and event management (SIEM) system.
Show answer & explanationAnswer & explanation
Correct answer: C. Integrating security configuration baselines and continuous compliance scanning.
Integrating security configuration baselines and continuous compliance scanning directly automates the validation of infrastructure configurations against security standards, providing rapid feedback and ensuring 'baked-in' security in a continuous delivery model typical of DevSecOps.
Why the other options are wrong
- A. Manual reviews and quarterly penetration tests are important but do not provide the continuous, automated feedback required for a true DevSecOps approach to 'baked-in' security.
- B. A security champion model promotes security awareness and expertise within teams but is a cultural/organizational practice, not a direct technical measure for continuous security validation.
- D. A SIEM is crucial for monitoring and incident response in production, but its primary role is not in *proactive, continuous validation* of configurations during development and deployment phases.
Continuous Security in DevSecOps
Integrating security practices and automation throughout the entire software development and deployment pipeline to ensure continuous validation and feedback.
- Automates security checks.
- Provides rapid feedback.
- Shifts security left (earlier in SDLC).
Memory trick: DevSecOps: 'Always Scan, Always Comply' for continuous safety.