A city applies CI/CD to detection content with lint, unit tests, and staged promote. What DevOps practice is that?
Select an answer to reveal the explanation.
Short Explanation
Detections deserve the same conveyor belt as app code—lint, test, then stage. Applying that same pipeline to detection-infra-as-code helps your platform plumbing, but it won't test your rules, so you'll still risk blind spots. CI/CD keeps detection-as-code honest.
Full Explanation
A city that applies CI/CD to detection content with lint, unit tests, and staged promote is practicing DevOps for civic detection-as-code. SIEM and detection rules are executable logic that can flood queues or miss real threats; lint and tests catch syntax and logic defects before promote, and staging validates behavior against municipal telemetry without immediately affecting production alerting. The pipeline makes detection changes auditable, repeatable, and safer than ad-hoc console edits during an incident week. Why the other options fail by concept: Applying DevOps CI/CD with lint, tests, and staged promote to civic detection-infra-as-code applies the same pipeline discipline to detection platform provisioning rather than detection content; it validates templates and infrastructure definitions for the detection pipeline, it does not lint detection logic or stage rules against municipal telemetry to control production alerting. Applying DevOps CI/CD with lint, tests, and staged promote to civic detection-SOAR-as-code applies the pipeline to response automation and SOAR workflows tied to detections rather than detection content; it validates workflow logic for incident response, it does not lint detection rules or stage them to tune alert rates and coverage. Applying DevOps CI/CD with lint, tests, and staged promote to civic detection-policy-as-code applies the pipeline to governance and tuning policies around detections rather than detection content; it validates policy definitions and controls, it does not lint detection syntax or stage rules to prove out fidelity against municipal telemetry. Exam caveat: CI/CD for detections improves delivery discipline; it does not guarantee detection efficacy against novel municipal threats—coverage review and tuning remain required. Operational check: enforce lint and unit tests on detection PRs, promote through a staging tenant or index set, compare alert rates, then promote to production with an owner and rollback revision ready.
Prefer to study offline? Printable PDF study book + test engine ($7.50, unofficial). These questions stay free here.