SDSI Application Security Design Practice Question
When designing a secure API lifecycle, which THREE activities should be automated in the CI/CD pipeline? (Choose THREE)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
API contract/schema testing
Automating security in CI/CD ensures that vulnerabilities are caught before they reach production.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disabling all logging for production performance
Why it's wrong here
Logging is mandatory for security.
- ✓
API contract/schema testing
Why this is correct
Schema testing ensures API integrity.
- ✓
Static Analysis Security Testing (SAST) for API code
Why this is correct
SAST finds vulnerabilities early in the code.
- ✓
Automated security policy provisioning for the API gateway
Why this is correct
Policy-as-code ensures consistent enforcement.
- ✗
Manual code review of every commit by the CISO
Why it's wrong here
Manual review is not scalable for CI/CD.
About these practice questions
This SDSI question is part of Courseiva's 299-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Cisco exam blueprint
This SDSI practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SDSI exam.