hardMultiple SelectObjective-mapped
200-901 Practice Question: Which THREE are best practices for securing a…
Which THREE are best practices for securing a CI/CD pipeline?
⚠ Common exam trap
Cisco often tests the distinction between DAST and SAST, where candidates may incorrectly think only one is needed, but the exam expects both as complementary practices for comprehensive security coverage.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use dynamic application security testing (DAST) tools
Dynamic application security testing (DAST) tools analyze a running application by simulating external attacks, which helps identify runtime vulnerabilities such as SQL injection or cross-site scripting. Integrating DAST into a CI/CD pipeline ensures that security checks are automated and performed before deployment, catching issues that static analysis might miss. This aligns with the DevSecOps principle of shifting security left without slowing down delivery.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use dynamic application security testing (DAST) tools
Why this is correct
DAST tests running applications for security issues.
- ✓
Allow manual approval for production deployments
Why this is correct
Manual approval ensures someone reviews changes before production deployment.
- ✗
Store credentials in the source code repository
Why it's wrong here
Storing credentials in source code exposes them to all users.
- ✗
Run all pipeline steps as the same user
Why it's wrong here
Running as same user reduces isolation and increases risk of privilege escalation.
- ✓
Use static application security testing (SAST) tools
Why this is correct
SAST analyzes source code for vulnerabilities.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-901 question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.