The city's delivery pipelines block merges that violate secure coding standards, yet emergencies occur. How should exceptions be handled?
Select an answer to reveal the explanation.
Short Explanation
Gates that enforce coding standards keep the city honest—until a real emergency needs a narrow detour. Approve the exception, put a clock on it, and close it. Forever-bypass is how standards die.
Full Explanation
Pipeline gates that enforce secure coding standards keep municipal delivery honest, but real emergencies sometimes need a narrow exception path. The correct pattern is to keep gates enforced by default and time-box any approved exceptions—named approver, documented justification, compensating controls, expiry date, and follow-up work to restore compliance. That preserves the control system's integrity while acknowledging operational reality for citizen-facing services.
Granting permanent silent bypasses to every product owner destroys the gate's value and creates untracked risk across portfolios.
Removing all gates after the first successful production release assumes one good deploy proves eternal safety; subsequent changes reintroduce risk and need continued enforcement.
Allowing unsigned, unreviewed hotfixes as the default path normalizes the highest-risk delivery mode instead of reserving emergency process for true incidents.
Exam caveat: exceptions must be governed and temporary—CISSP favors controlled break-glass over permanent bypass culture. Operational check: implement exception tickets with automatic expiry, alert when bypasses are used, require post-incident removal of waivers, and report recurring exception patterns to leadership so systemic issues (flaky gates, understaffing) get fixed rather than endlessly waived.