easyMultiple ChoiceObjective-mapped
CISSP Practice Question: A DevOps team implements a CI/CD pipeline that…
A DevOps team implements a CI/CD pipeline that runs security scans automatically. The pipeline fails often due to false positives, causing delays. Which approach balances security and efficiency?
⚠ Common exam trap
ISC2 often tests the misconception that 'security must never be compromised,' leading candidates to choose manual review (C) or full scans (D), but the CISSP emphasizes risk-based decisions where tuning is the pragmatic balance between security and efficiency.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Tune scan rules to reduce false positives while retaining critical checks.
Tuning scan rules reduces false positives by adjusting thresholds or disabling low-severity checks while preserving critical security controls (e.g., SAST rules for OWASP Top 10). This maintains automated security validation in the CI/CD pipeline without blocking development velocity, aligning with the principle of 'secure enough' rather than 'perfect security'.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Tune scan rules to reduce false positives while retaining critical checks.
Why this is correct
Tuning scan rules involves refining the configurations of security tools, such as Static Application Security Testing (SAST) or Dynamic Application Security Testing (DAST), to align with the application's specific context and risk profile. This process aims to minimize the number of non-actionable false positives, which can overwhelm development teams and lead to alert fatigue, while ensuring that genuine, critical vulnerabilities are still accurately identified and flagged. By customizing rule sets, teams can maintain a high signal-to-noise ratio, making security findings more relevant and actionable within the rapid CI/CD cycle.
- ✗
Turn off all security scans.
Why it's wrong here
Completely disabling all security scans within a CI/CD pipeline is a critically flawed approach that eliminates any automated detection of vulnerabilities. This action would leave the application entirely exposed to known and unknown security flaws, significantly increasing its attack surface and overall risk posture. Such a decision would lead to substantial security debt, potential data breaches, and severe compliance violations, directly undermining the fundamental principles of secure software development and DevSecOps.
- ✗
Manually review every false positive.
Why it's wrong here
Manually reviewing every single false positive generated by automated security scans is an unsustainable and inefficient practice within a CI/CD pipeline. This approach creates a significant bottleneck, consuming excessive developer time and resources that should be focused on feature development and genuine vulnerability remediation. It directly contradicts the core principle of automation in CI/CD, drastically slowing down the delivery pipeline and negating the benefits of continuous integration and continuous delivery by introducing a laborious, manual gate.
- ✗
Only run scans on code that is deployed to production.
Why it's wrong here
Restricting security scans solely to code deployed in production environments is a "shift right" strategy that misses the critical opportunity to identify and remediate vulnerabilities early in the development lifecycle. This approach dramatically increases the cost and complexity of fixing security flaws, as issues found in production are far more expensive and disruptive to resolve than those caught during development or testing phases. It also exposes the application to unnecessary risk for an extended period, failing to leverage the proactive security benefits of DevSecOps.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.