easyMultiple ChoiceObjective-mapped
CISSP Practice Question: Uses a version control system for all software…
An organization uses a version control system for all software development. Which practice best ensures that code changes are reviewed for security issues before merging into the main branch?
⚠ Common exam trap
Watch out — candidates often confuse automated security testing (like SAST in CI) with the human review process, assuming that automated checks alone are sufficient for security, whereas the CISSP emphasizes the necessity of peer review for catching complex security flaws that tools cannot reliably detect.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Requiring all pull requests to be approved by at least one peer reviewer.
Requiring pull request approval by at least one peer reviewer ensures that code changes are manually inspected for security flaws before merging into the main branch. This practice leverages human expertise to catch logic errors, insecure patterns, and design weaknesses that automated tools might miss, aligning with the principle of defense in depth in the software development lifecycle.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Requiring all pull requests to be approved by at least one peer reviewer.
Why this is correct
Requiring peer review for all pull requests is a critical security control because human reviewers can identify complex logical flaws, design vulnerabilities, and business logic errors that automated static analysis tools often miss. This manual inspection allows for a deeper understanding of the code's intent and potential misuse, ensuring adherence to secure coding standards and architectural principles before changes are integrated into the main codebase. It provides an essential layer of defense against subtle security defects.
- ✗
Configuring the CI pipeline to run static analysis tools only on the main branch.
Why it's wrong here
Configuring static analysis tools to run only on the main branch is an insufficient security measure because it delays the detection of vulnerabilities until code is already integrated. Security issues introduced in feature branches can persist for extended periods, potentially propagating to other developers or even production environments without early detection. This "shift-right" approach increases the cost and complexity of remediation, as flaws are harder to fix once merged and integrated.
- ✗
Enforcing that all commits pass automated unit tests before merging.
Why it's wrong here
Enforcing that all commits pass automated unit tests before merging is primarily focused on validating the functional correctness and expected behavior of individual code components, not their security posture. Unit tests typically do not cover common security vulnerabilities such as injection flaws, authentication bypasses, or cryptographic misconfigurations. While essential for quality, passing unit tests does not inherently guarantee the absence of security weaknesses in the code.
- ✗
Using pre-commit hooks to scan for secrets in code before commit.
Why it's wrong here
While using pre-commit hooks to scan for secrets is a valuable preventative measure to stop sensitive data from entering the repository, it is not a comprehensive security control for the entire codebase. Pre-commit hooks are limited to specific pattern matching and cannot identify broader security vulnerabilities like architectural design flaws, insecure third-party dependencies, or logical access control issues. They address only a very narrow subset of potential security risks.
Go deeper
Related to this question
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.