Palo Alto Networks Certified Cloud Security Engineer (PCCSE)DevSecOps and Shift Left SecurityHard
A release manager is overseeing the deployment of a critical application. The company's policy dictates that no application with a 'critical' or 'high' severity vulnerability, as identified by SAST, should ever be deployed to production. To automate this policy, the CI/CD pipeline needs to be configured such that if a Prisma Cloud Code Security scan identifies such vulnerabilities, the deployment stage is automatically aborted. Which specific mechanism within a typical CI/CD pipeline enables this automated abortion based on security scan results?
- AManual approval gates requiring security team sign-off.
- BPost-deployment rollback scripts triggered by CSPM alerts.
- CNetwork firewall rules blocking traffic to non-compliant deployments.
- DConditional stage execution based on the previous stage's exit code.
Show answer & explanationAnswer & explanation
Correct answer: D. Conditional stage execution based on the previous stage's exit code.
Most CI/CD platforms allow stages or jobs to be configured with dependencies and conditions. If a preceding security scan (like Prisma Cloud Code Security) is configured to exit with a non-zero status code (indicating failure) when critical/high vulnerabilities are found, subsequent deployment stages can be conditionally set to abort, effectively blocking the deployment.
Why the other options are wrong
- A. Manual approval gates are a human-driven process, not an automated abortion mechanism.
- B. This is a post-deployment remediation, not a mechanism to prevent initial deployment.
- C. Network firewall rules are for runtime traffic control, not for blocking a CI/CD deployment stage.
CI/CD Pipeline Gates
Automated checks or conditions within a CI/CD pipeline that must be met for the pipeline to proceed to the next stage, often used for quality, security, or compliance enforcement.
- Can be based on test results, scan findings, or policy violations.
- Often implemented via exit codes or specific status checks.
- Essential for 'shift-left' and 'fail-fast' strategies.
Memory trick: Gates ensure only good code gets to run free.