CISSP Exam - Question 101

CISSP Official Study Guide pg 966 "...organizations using the DevOps model often deploy code several times per day. Some organizations even strive to reach the goal of continuous integration/continuous delivery (CI/CD), where code may roll out dozens or even hundreds of times per day. This requires a high degree of automation, including integrating code repositories, the software configuration management process, and the movement of code between development, testing, and production environments."

D. The Change Review Board (CRB) assists in the assessment and prioritization of changes and approves requested changes...Ensure that all changes adhere to quality requirements (i.e. testing is completed, roll-back plans are in place etc.)

In a DevOps environment, receiving approval from the change review board (option D) can indeed be an important step to ensure confidence in the quality of changes being made. The change review board plays a vital role in reviewing and approving changes to be deployed to the production environment. By obtaining approval from the change review board, organizations can ensure that changes have undergone thorough review and evaluation, including considerations for potential impacts on security, stability, compliance, and overall alignment with the organization's objectives. While automating functionality testing (option B) is also a crucial aspect of DevOps to validate changes, it is not the only factor in ensuring confidence in the quality of changes. A holistic approach that includes various practices, such as automated testing, change approval, monitoring, and continuous feedback, is typically necessary for achieving a high level of confidence in the quality of changes in a DevOps environment. Therefore, both options D (receiving approval from the change review board) and B (automating functionality testing) are important considerations, and the specific importance may vary depending on the organization's processes and requirements.

D. Think like a manager.

I think D

D. change management is still required in DevOps environment. This becomes a wording problem, D is the answer. D. Receive approval from the change review board is MOST necessary to have confidence in the quality of the changes being made. A. Prepare to take corrective actions quickly is MOST necessary to have confidence in the quality of the changes being made.

According to CISSP 9th ed., DevOps and DevSecOps move to frequent code reviews, multiple daily. Although it is not clearly defined in this text, the only practical answer listed would be B. To keep up with multiple code submissions daily the testing needs to be automated to prevent bottlenecking by security and code reviews.

Answer is B. In DevOps the changes doesn't go through the CAB that's why you need to make sure the quality of the changes are good

approval come first

ACD are more relevant to monitoring and evaluating the changes after they are deployed

A successful DevOps testing strategy is one aimed at building, testing and releasing software faster and more frequently. If you're lucky enough to start out in a "greenfield" organization without an established coding culture, it's a good idea to try to create and automate your software delivery pipeline upfront. If you're successful out-of-the-gate in creating a Continuous Delivery DevOps pipeline, your business will be much more competitive since you'll be able to get higher-quality software into the hands of your users and customers faster than your competitors, and you'll be able to react to business demand and change much more rapidly. reference : https://smartbear.com/blog/devops-testing-strategy-best-practices-tools/#:~:text=A%20successful%20DevOps%20testing%20strategy%20is%20one%20aimed%20at%20building,your%20software%20delivery%20pipeline%20upfront.

B. Automate functionality testing. In DevOps, the emphasis is on automation, continuous integration, and continuous delivery (CI/CD) processes. Automated testing provides immediate feedback to development teams, helping them catch and fix issues early in the development process, reducing the likelihood of introducing defects into the production environment.

As CI/CD makes multiples changes is very important to test if functionality is not broken because of a change

Testing is part of the approval process. CAB won't approve CR if it's not tested.

Strongly torn between B and D, but I'm leaning towards B because of it being DevOps

Devops means frenquent changes. CAB is good - and necessary, but a CAB done too often, sometimes several time a week will not guarantee anything on the quality of the change. Automated functional tests on the other hand, allows you to be reactive on the change, before and after.

Change management is critical to vet for changes to go to production, and changes in production does not happen frequently. On the other hand, in DevOps environments, changes happen frequently which needs thorough testing before they can go to production, so it’s not ideal to go to Change Board frequently for these type of changes.