mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: A DevOps team is implementing a DevSecOps pipeline
A DevOps team is implementing a DevSecOps pipeline. Which of the following should be introduced first in the pipeline to catch security issues early and reduce remediation cost?
⚠ Common exam trap
ISC2 often tests the concept of 'shift left' by making candidates think SAST is the earliest security test, but pre-commit hooks execute even before the commit, making them the true first line of defense in a DevSecOps pipeline.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Pre-commit hooks that run linters and secret scanners
Pre-commit hooks run linters and secret scanners before code is even committed to the repository, catching issues like hardcoded credentials, insecure patterns, or syntax errors at the earliest possible point in the development lifecycle. This aligns with the DevSecOps principle of 'shift left'—finding defects earlier dramatically reduces remediation cost compared to post-build or post-deployment testing. Unlike later stages, pre-commit hooks prevent vulnerable code from entering the shared codebase, stopping issues before they propagate.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Container vulnerability scanning after image build
Why it's wrong here
While crucial for identifying known vulnerabilities in base images and dependencies, container vulnerability scanning typically executes post-build, once the Docker image or similar artifact has been constructed. This places it significantly later in the DevSecOps pipeline than pre-commit checks, meaning issues are detected after they've already been integrated into a build artifact, increasing remediation cost and effort compared to earlier detection.
- ✗
Static application security testing (SAST) during the build stage
Why it's wrong here
Static Application Security Testing (SAST) tools analyze source code, bytecode, or binary code for security vulnerabilities without executing the application. Performing SAST during the build stage is a valuable practice, as it identifies potential flaws before deployment. However, this occurs after the developer has committed their code to the repository, making it a later detection point compared to checks that run before the commit, thereby missing the opportunity for immediate developer feedback.
- ✓
Pre-commit hooks that run linters and secret scanners
Why this is correct
Pre-commit hooks are scripts configured to execute automatically on a developer's local machine before the `git commit` command successfully completes. By integrating linters, which enforce coding standards and identify syntax errors, and secret scanners, which detect hardcoded credentials or sensitive information, these hooks provide immediate feedback. This mechanism ensures that security issues and quality concerns are identified and remediated at the absolute earliest possible stage, preventing flawed code from ever entering the shared repository.
- ✗
Dynamic application security testing (DAST) in staging environment
Why it's wrong here
Dynamic Application Security Testing (DAST) involves testing a running application from the outside, simulating attacks to identify vulnerabilities like injection flaws or misconfigurations. While essential for uncovering runtime issues and verifying the effectiveness of other security controls, performing DAST in a staging environment means the application has already been built, deployed, and configured. This places DAST very late in the DevSecOps pipeline, making it a costly and time-consuming stage for discovering fundamental security defects that could have been prevented much earlier.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
DevSecOps
DevSecOps is a software development practice that integrates security into every phase of the DevOps lifecycle, making security a shared responsibility from the start.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.