hardMultiple ChoiceObjective-mapped
CISSP Is adopting DevOps Practice Question
An organization is adopting DevOps. Which of the following is a primary security concern when integrating security into CI/CD pipelines?
⚠ Common exam trap
The trap here is that candidates may focus on operational or cultural issues (like resistance or speed) instead of the fundamental technical risk of credential exposure in automated, unattended processes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Credential management for automated tools.
Credential management for automated tools is a primary security concern because CI/CD pipelines require automated access to repositories, artifact registries, and deployment environments. Hardcoding secrets or using weak storage (e.g., plaintext in scripts) exposes credentials to compromise via pipeline logs, version control history, or insider threats. Proper management using vaults (e.g., HashiCorp Vault) or secret injection (e.g., Kubernetes Secrets) is critical to prevent unauthorized access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Credential management for automated tools.
Why this is correct
In a DevOps environment, automated tools frequently require access to various systems, repositories, and environments. If these credentials are hardcoded, stored insecurely in source control, or managed without robust secrets management solutions, they become a critical attack vector. A compromise of such credentials could grant an attacker extensive unauthorized access across the entire software delivery pipeline, from development to production, leading to data breaches or system manipulation. This makes secure credential management a paramount security challenge.
- ✗
Increased number of releases.
Why it's wrong here
While an increased number of releases might seem to introduce more opportunities for vulnerabilities, the core principle of DevOps is to enable frequent, small, and secure deployments. When implemented correctly with robust automated testing, security scanning, and continuous monitoring integrated into the CI/CD pipeline, more frequent releases can actually reduce the blast radius of any single defect and allow for quicker remediation of identified vulnerabilities. Therefore, the *number* of releases is not the primary security challenge; rather, it's the security posture of the release process itself.
- ✗
Automated testing slows down deployment.
Why it's wrong here
The potential for automated testing to slow down deployment is primarily an operational efficiency and performance challenge, not a direct security concern. While inefficient testing might delay the delivery of secure code, it does not inherently introduce security vulnerabilities. Modern CI/CD practices emphasize optimizing test suites for speed and parallel execution, ensuring that comprehensive security and functional tests can run efficiently without significantly impeding deployment velocity. The goal is to integrate security testing seamlessly, not to sacrifice it for speed.
- ✗
Resistance from development teams.
Why it's wrong here
Resistance from development teams, often stemming from changes in workflows, toolchains, or perceived increases in workload, represents a significant cultural and organizational adoption challenge for DevOps. While cultural friction can indirectly impact security by hindering the implementation of secure practices, it is not a direct technical security vulnerability or threat vector itself. Addressing this requires strong leadership, clear communication, training, and demonstrating the benefits of secure DevOps practices, rather than technical security controls.
Go deeper
Related to this question
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.