Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified Information Systems Auditor · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Secure code reviews in a continuous deployment or DevSecOps pipeline are a type of preventive control because they are conducted before the code is deployed to production. Their goal is to identify and fix vulnerabilities early, thus preventing security flaws from being introduced into the live environment. Why not the others? A. Detective Detective controls identify issues after they occur (e.g., logging, monitoring, or alerts). Code reviews are proactive. B. Corrective Corrective controls remediate issues after detection, such as applying patches. Code reviews aim to prevent the issue in the first place. C. Logical Logical controls relate to access, authentication, and authorization — not code review processes specifically.
Secure code reviews are a preventive control in a continuous deployment program. The primary purpose of a secure code review is to identify and mitigate security flaws before code is deployed to production. By examining the code for vulnerabilities and weaknesses during the development lifecycle, organizations aim to prevent potential security breaches and operational issues.
If the code review happens before deployment, it is preventive. It depends on the interpretation.