easyMultiple ChoiceObjective-mapped
CISSP Practice Question: Implementing a CI/CD pipeline for a web…
A company is implementing a CI/CD pipeline for a web application. Which security testing method should be integrated into the build stage to catch vulnerabilities early?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Static Application Security Testing (SAST) in the build stage
Static Application Security Testing (SAST) analyzes source code without execution, making it suitable for early detection in the build stage of a CI/CD pipeline. Option A is incorrect because open-source vulnerability scanners may not cover custom code and can produce false positives. Option B is incorrect because Dynamic Application Security Testing (DAST) requires a running application and is typically performed in later stages. Option C is incorrect because manual code review is too slow and resource-intensive for continuous integration, while automated SAST fits the speed of CI/CD.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Only using open-source vulnerability scanners
Why it's wrong here
While open-source vulnerability scanners offer valuable baseline security checks and are cost-effective, relying solely on them is insufficient for a comprehensive CI/CD pipeline. They often lack the advanced detection capabilities, detailed reporting, and support for proprietary frameworks or custom code specific to enterprise applications. This approach leaves significant security gaps, particularly for complex business logic vulnerabilities or compliance requirements that demand more rigorous, specialized tooling.
- ✗
Dynamic Application Security Testing (DAST) in the production stage
Why it's wrong here
Performing Dynamic Application Security Testing (DAST) exclusively in the production stage is a critical misstep in a CI/CD pipeline. DAST operates on a running application, identifying vulnerabilities from an attacker's perspective, but discovering issues only in production introduces significant risk and cost. Fixing vulnerabilities at this late stage is expensive, delays deployment, and exposes the live environment to potential threats before remediation can occur, contradicting the "shift left" security principle.
- ✗
Manual code review after each sprint
Why it's wrong here
Conducting manual code reviews after each sprint, while valuable for quality assurance, is inherently too slow and resource-intensive for the rapid iteration cycles of a CI/CD pipeline. The continuous integration and continuous delivery model demands automated, fast feedback loops. Relying on manual processes at this frequency creates bottlenecks, significantly delays deployments, and prevents the agile responsiveness necessary for modern software development, making it impractical for continuous security integration.
- ✓
Static Application Security Testing (SAST) in the build stage
Why this is correct
Integrating Static Application Security Testing (SAST) into the build stage is a fundamental best practice for securing CI/CD pipelines. SAST analyzes source code, bytecode, or binary code for security vulnerabilities without executing the application, allowing developers to identify and remediate flaws early in the development lifecycle. This "shift left" approach provides immediate feedback, reduces the cost of fixing defects, and prevents insecure code from progressing further, aligning perfectly with the speed and automation of CI/CD.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.