CCSP Cloud Application Security Practice Question
A retail company migrates its customer-facing web application to a cloud environment. The security team wants to ensure that security testing is integrated throughout the software development lifecycle (SDLC) rather than only before production deployment. Which approach best aligns with this goal?
⚠ Common exam trap
The trap here is assuming that periodic security gates or annual training are sufficient for continuous security, when the goal requires automated, integrated testing throughout the SDLC.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Adopt a DevSecOps approach with automated security testing in the CI/CD pipeline.
Integrating security testing into the CI/CD pipeline through a DevSecOps approach ensures that vulnerabilities are identified and addressed continuously as code is developed and deployed. This shifts security left, reduces remediation costs, and aligns with modern cloud application security best practices. Other options either delay testing or rely solely on human training, which does not provide the continuous automated assurance required.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Adopt a DevSecOps approach with automated security testing in the CI/CD pipeline.
Why this is correct
A DevSecOps approach integrates security automatically into every stage of the CI/CD pipeline, enabling early detection and remediation of vulnerabilities. This aligns with the goal of continuous security testing throughout the SDLC. Automated tools like SAST, DAST, and dependency scanning run with each build, providing rapid feedback to developers. This reduces risk and cost compared to late-stage testing, and fosters a security-first culture.
- ✗
Implement security gates at the end of each development sprint.
Why it's wrong here
Placing security gates only at the end of each sprint delays feedback and does not embed security continuously. It may catch issues late when remediation is costly and can create bottlenecks. The goal is to integrate security throughout the SDLC, not just at sprint boundaries. Continuous integration of security practices, such as automated scanning in the CI/CD pipeline, is more effective for early detection and faster remediation.
- ✗
Require developers to complete annual secure coding training.
Why it's wrong here
Annual training is important but does not provide continuous, automated security testing throughout the SDLC. It relies on human behavior and knowledge retention, which can be inconsistent. The scenario emphasizes integrating security testing into the development process, which training alone cannot achieve. Automated tools in the pipeline offer consistent, repeatable checks that complement training.
- ✗
Conduct a penetration test after the application is deployed to production.
Why it's wrong here
Penetration testing in production occurs after deployment, which is too late to prevent vulnerabilities from reaching production. While valuable, it is a point-in-time assessment and not continuous. The scenario specifically calls for security testing throughout the SDLC, not just post-deployment. Relying solely on production pen tests leaves the application exposed during development and increases remediation costs.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.