Isaca Certified Information Systems Auditor CISA Question # 102 Topic 11 Discussion
CISA Exam Topic 11 Question 102 Discussion:
Question #: 102
Topic #: 11
An organization uses an automated continuous integration/continuous deployment (CI/CD) tool to deploy changes to production. Which of the following would be an IS auditor ' s GREATEST concern in this situation?
A.
Releases are scheduled once per week.
B.
Post-implementation reviews are conducted quarterly.
C.
Test cases may be inaccurate.
D.
Functional requirements are changed frequently by users.
The greatest concern in a CI/CD environment is the accuracy of automated testing. Since code is deployed rapidly and often without manual intervention, weak or inaccurate test cases can allow vulnerabilities and defects to be pushed directly into production. Release frequency (A) and changing user requirements (D) are expected characteristics of agile/DevOps models and can be managed with governance. Delayed post-implementation reviews (B) may reduce oversight but do not directly undermine the core pipeline integrity. ISACA’s DevOps guidance emphasizes that automated testing and validation of requirements must be thorough and reliable to ensure continuous deployment does not compromise quality or security.
References (ISACA): COBIT® Focus Area for DevOps; BAI06 Managed IT Changes.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit