hardMultiple ChoiceObjective-mapped
CISSP Practice Question: A global technology firm has implemented a…
A global technology firm has implemented a continuous integration/continuous deployment (CI/CD) pipeline for its flagship software product. The security testing team is tasked with integrating security testing into the pipeline. The team has decided to use a static application security testing (SAST) tool and a software composition analysis (SCA) tool. They are currently running both tools every night against the entire codebase, but the developers complain that the reports are too long and often contain false positives. The team wants to improve the efficiency without sacrificing security coverage. Which of the following is the BEST strategy?
⚠ Common exam trap
Candidates often choose Option D (scan only new code) because it seems efficient, but they overlook the need for continuous scanning of the entire codebase to catch regressions and vulnerabilities in unchanged code, which is a core requirement for maintaining security coverage in CI/CD pipelines.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a developers' feedback loop for false positives and tune the tools.
Tuning the SAST and SCA tools based on developer feedback directly addresses the false positive issue while maintaining security coverage. By establishing a feedback loop, the team can adjust rule sets, suppress known false positives, and reduce report noise without reducing scan frequency or scope. This approach aligns with the principle of continuous improvement in DevSecOps, ensuring that security testing remains efficient and actionable.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Decrease the scan frequency to weekly to reduce noise.
Why it's wrong here
Decreasing scan frequency to weekly is counterproductive in a continuous integration environment. This action significantly delays the detection of new vulnerabilities, increasing the mean time to detect (MTTD) and mean time to remediate (MTTR) actual security flaws. Furthermore, it does not address the root cause of false positives; it merely reduces the volume of alerts, leaving the underlying accuracy issues unaddressed and potentially masking critical threats.
- ✓
Implement a developers' feedback loop for false positives and tune the tools.
Why this is correct
Implementing a developers' feedback loop for false positives is crucial for refining security tools and processes. This mechanism allows developers to report inaccurate alerts, providing essential data for security teams to tune SAST and SCA tools effectively. Tuning involves creating custom rules, adjusting sensitivity, or suppressing known benign patterns, which significantly reduces alert fatigue, improves the signal-to-noise ratio, and ensures that legitimate vulnerabilities are prioritized and addressed efficiently without sacrificing comprehensive scanning.
- ✗
Replace SAST with dynamic application security testing (DAST) for more accurate results.
Why it's wrong here
Replacing SAST with DAST is an inappropriate solution as they serve distinct, complementary purposes in the software development lifecycle. SAST analyzes source code pre-execution to identify vulnerabilities like injection flaws, providing early feedback. DAST, conversely, tests the running application from an attacker's perspective, uncovering runtime issues such as misconfigurations or authentication flaws. Eliminating SAST would leave critical code-level vulnerabilities undetected during development, shifting detection much later and increasing remediation costs.
- ✗
Run SAST and SCA only on new code changes committed to the main branch.
Why it's wrong here
Running SAST and SCA solely on new code changes committed to the main branch creates significant security blind spots. This approach completely neglects the existing codebase, which often contains legacy vulnerabilities that remain exploitable and accessible in production. While it might accelerate CI/CD pipelines, it fails to provide comprehensive security coverage for the entire application, leaving the organization exposed to risks from previously undetected flaws in older, actively used code.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
DevSecOps
DevSecOps is a software development practice that integrates security into every phase of the DevOps lifecycle, making security a shared responsibility from the start.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.