Developers release code many times a day through an automated pipeline. A quarterly manual security review cannot keep pace and finds flaws only after they reach production. What is the BEST approach?
Select an answer to reveal the explanation.
Short Explanation
You can't inspect a high-speed conveyor belt by walking past it once a quarter; you build the inspection into the belt. When code ships many times a day, your security checks have to ship with it. The trap is slowing the business down or just reviewing a bit more often.
Full Explanation
When delivery is continuous, security checks must be continuous too. Integrating automated security testing into the build and deployment pipeline, such as code analysis, dependency checks and configuration tests with defined thresholds that block or flag releases, catches many flaws before they reach production and gives developers fast feedback in their normal workflow. Manual expert review can then focus on higher-risk changes. Pausing all releases until a quarterly review is complete would remove the business benefit of rapid delivery and is unlikely to be accepted; it also creates enormous review batches. Moving the manual review to monthly still leaves weeks between a release and its review, during which dozens of releases reach production unchecked, and the review effort would rise without solving the timing gap. Relying on a production firewall to block exploitation treats a network control as a substitute for secure code; many application flaws are exploited through legitimate traffic that perimeter controls permit. Exam caveat: automated tools do not catch every class of flaw, so CISM expects a risk-based combination of automated checks, secure design and targeted manual review. Operational check: confirm that every production deployment passes through the security stage, measure the share of releases blocked or flagged and track how quickly flagged issues are fixed.