Isaca Certified Information Systems Auditor CISA Question # 264 Topic 27 Discussion
CISA Exam Topic 27 Question 264 Discussion:
Question #: 264
Topic #: 27
A small IT department has embraced DevOps, which allows members of this group to deploy code to production and maintain some development access to automate releases. Which of the following is the MOST effective control?
A.
Enforce approval prior to deployment by a member of the team who has not taken part in the development.
B.
The DevOps team provides an annual policy acknowledgment that they did not develop and deploy the same code.
C.
Annual training reinforces the need to maintain segregation between developers and deployers of code
D.
The IT compliance manager performs weekly reviews to ensure the same person did not develop and deploy code.
The most effective control to maintain segregation of duties in a DevOps environment is A. Enforce approval prior to deployment by a member of the team who has not taken part in the development. Segregation of duties (SoD) is a principle that requires multiple actors to complete a task to reduce the risk of fraud, error, or abuse1. In a DevOps environment, where developers and operators work together to deliver software faster and more reliably, SoD may seem to be incompatible or impractical. However, SoD can still be achieved by implementing controls that ensure that no single person can develop, test, and deploy code without oversight or review2.
Enforcing approval prior to deployment by a member of the team who has not taken part in the development is an effective control that ensures that code changes are verified and validated by a peer before they are released to production. This control can help prevent or detect any unauthorized or malicious modifications, errors, or vulnerabilities in the code, and ensure that the code meets the quality and security standards3. This control can also promote collaboration and feedback among the team members, and improve the transparency and accountability of the software delivery process3.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit