hardMultiple Choice
CRISC Practice Question: A software development company uses a DevOps…
A software development company uses a DevOps pipeline with automated code deployment. Recently, a developer accidentally pushed a configuration file containing database credentials to a public repository. The credentials were changed within an hour, but the file remained public for a few hours. The risk team is now identifying risks in the CI/CD process. The security team has proposed adding static code analysis to detect secrets in code. The development team objects, citing false positives. The risk manager must identify the most significant risk that could lead to a data breach. Which risk should be prioritized?
⚠ Common exam trap
The trap here is that candidates focus on the incident response or training aspects (options A and D) because they seem like common root causes, but the question specifically asks for the most significant risk that could lead to a data breach, which is the lack of a preventive control (pre-commit scanning) that directly stops secrets from entering the repository.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Lack of pre-commit hooks or automated scanning to prevent secrets from being committed.
The root cause of the incident was the absence of automated, pre-commit scanning to detect secrets before they are pushed to a repository. Pre-commit hooks (e.g., using tools like git-secrets or Talisman) or server-side scanning (e.g., GitHub secret scanning) can block credentials from being committed in the first place, directly preventing exposure. Without this control, the CI/CD pipeline lacks a critical preventive layer, making data breaches more likely despite post-commit remediation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Insufficient training on secure coding practices for developers.
Why it's wrong here
Training is a long-term cultural control and cannot deterministically block a credential from entering the repository; the stem needs a preventive detection gate. Training would be the priority where repeated developer errors show a knowledge gap rather than a missing automated control.
- ✗
Over-reliance on manual code reviews which are error-prone.
Why it's wrong here
The stem describes automated code deployment, so manual review is not the control that failed; the credential bypassed the pipeline's existing checks. Manual review is the correct focus where deployments lack automation and human inspection is the sole gate.
- ✓
Lack of pre-commit hooks or automated scanning to prevent secrets from being committed.
Why this is correct
Automated pre-commit hooks or secret scanning would have blocked the credential file before it entered the repository, directly addressing the CI/CD control gap that allowed exposure. Static analysis alone, run later, leaves the commit window open; prevention at commit time satisfies the pipeline constraint the stem describes.
- ✗
Inadequate incident response procedures for exposed credentials.
Why it's wrong here
Credentials were rotated within an hour, so response worked; the exposure window stemmed from secrets reaching the repository undetected. Incident response is the right priority when detection fails and credentials remain live, not when rotation already contained the exposure.
Go deeper
Related to this question
About these practice questions
One of 1,062 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.