Courseiva
← CCSP
Full test
mediumMultiple ChoiceObjective-mapped

CCSP Practice Question: Is integrating security into a cloud…

A security engineer is integrating security into a cloud application's CI/CD pipeline. Which practice is an example of 'shift-left' security?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Running SAST scans during pull request review

Shift-left security means performing security activities early in the development lifecycle. Running SAST during the coding phase, before code is merged, is a classic shift-left practice. The other options are either reactive or occur later.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    Performing a penetration test after deployment

    Why it's wrong here

    Penetration testing after deployment is a traditional, right-shift activity.

  • ✗

    Analyzing logs after an incident

    Why it's wrong here

    Post-incident analysis is reactive and late in the cycle.

  • ✓

    Running SAST scans during pull request review

    Why this is correct

    SAST scans during code review catch vulnerabilities before merge, embodying shift-left.

  • ✗

    Scanning container images in production

    Why it's wrong here

    Scanning in production is reactive, not early in the lifecycle.

About these practice questions

Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.