To speed up releases of a cloud application, the developers propose to perform and approve their own security testing and to remove the separate quality assurance function from the process. What is the main reason a cloud security professional should object?
Select an answer to reveal the explanation.
Short Explanation
Grading your own exam is fast, and you'll probably give yourself an A. QA exists so somebody without a stake in the code checks it with fresh eyes. The other options invent rules that don't exist; the real issue is independence.
Full Explanation
Quality assurance in software assurance provides independent verification that software meets its functional and security requirements. Independence matters because the people who wrote the code share its assumptions; they test the paths they expect, overlook misuse they did not imagine, and face pressure to approve their own work to meet deadlines. Separating the roles of building and verifying is an application of separation of duties, and it produces evidence that auditors and customers can rely on. Developer testing complements, rather than replaces, an independent function. The claim that developers cannot reach the test environment is a statement about access, not a reason for independence; access can be granted, and the conflict of interest would remain. Cloud provider terms of service govern use of the provider's infrastructure, sometimes including rules about penetration testing, but they do not mandate a customer's internal QA structure or prohibit developers from testing their own applications. Security testing is not restricted to after deployment; static analysis, dependency scanning and dynamic testing in staging all happen before release. Exam caveat: in DevOps teams QA independence can be achieved through automated gates and separate approval rights rather than a separate department. Operational check: confirm release approvals require a reviewer who did not author the change, and that security test results are reviewed independently.