How to Reduce IaC Deployment Failures in a CI/CD Pipeline?

CA1-005 By islever Editorial Last updated

Given a scenario, implement security in the early stages of the systems life cycle and throughout subsequent stages. Given a scenario, securely implement cloud capabilities in an enterprise environment.

Short answer

BF Use pre-commit code linting to catch syntax and formatting defects and pipeline compliance scanning to block IaC policy violations before deployment.

Question

A company updates its cloud-based services by saving infrastructure code in a remote repository. The code is automatically deployed into the development environment every time the code is saved to the repository. The developers express concern that the deployment often fails, citing minor code issues and occasional security control check failures in the development environment. Which of the following should a security engineer recommend to reduce the deployment failures? (Choose two.)
  1. Software composition analysis
  2. Pre-commit code linting Correct Answer
  3. Repository branch protection
  4. Automated regression testing
  5. Code submit authorization workflow
  6. Pipeline compliance scanning Correct Answer

Key Takeaways

The question tests whether you can map each symptom to a shift-left control: linting for code quality and compliance scanning for IaC policy violations. The common trap is choosing broad deployment safeguards such as regression testing or branch protection that do not catch either failure type.

Pre-commit code linting and pipeline compliance scanning address the two failure classes in this scenario: minor code defects and IaC security-control violations. Together they shift validation left, before the automated development deployment runs.

Common mistake: Many learners pick automated regression testing or repository branch protection because they sound like deployment safeguards, but neither catches syntax errors, malformed YAML/JSON, or IoC policy violations before the pipeline deploys them.

Expert Analysis

Why the Answer Is Correct

Pre-commit code linting directly targets the first symptom: minor code issues that cause frequent build crashes. Linting validates syntax, formatting, and template structure such as YAML/JSON before the code is committed, so malformed infrastructure code never reaches the deployment stage. Pipeline compliance scanning targets the second symptom: security control check failures in the development environment, because it evaluates IaC against policy and compliance rules before deployment. As BWH9492 summarized, the stem separates "Minor code issues (syntax errors, formatting flaws, malformed YAML/JSON templates)" from "Security control check failures" such as misconfigured firewall rules or unencrypted storage buckets. Choosing B and F therefore gives one control per failure class and moves detection earlier in the CI/CD pipeline.

Why the Other Options Are Wrong

Software composition analysis examines third-party dependencies for known vulnerabilities; it does not lint first-party code or enforce IaC security policy. Repository branch protection limits who can push or merge, but it does not validate the content of the code, so syntax errors and policy violations still pass through. Automated regression testing runs after a build or deployment and checks functional behavior, which is too late and too broad to prevent minor template defects or security-control failures. A code submit authorization workflow adds human approval but does not automatically detect linting errors or compliance violations in the infrastructure code.

Community Comment Notes

BWH9492 frames the scenario as two distinct problems, which supports selecting one control for code quality and one for security compliance rather than a single broad safeguard. That framing is consistent with the shift-left intent of the question: catch defects at commit time and catch policy violations before deployment. The comment's examples of misconfigured firewall rules and unencrypted storage buckets align with what pipeline compliance scanning is designed to flag. This makes B and F the most defensible pair.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a stem separates 'code issues' from 'security control check failures,' look for one control per symptom. Eliminate options that operate after deployment, such as regression testing, or only govern who can merge, such as branch protection.

Frequently Asked Questions

Why isn't automated regression testing enough to prevent these deployment failures?

Regression testing validates behavior after a build; it does not catch syntax errors in IaC templates or policy violations before the pipeline deploys them.

Does repository branch protection reduce IaC deployment failures?

No. Branch protection controls who can merge code, but it does not lint the templates or scan them for security-control violations.

More CA1-005 FAQ →

Discussion 1 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 1

  1. BWH9492 👍 1
    Minor code issues (syntax errors, formatting flaws, malformed YAML/JSON templates) causing build crashes. Security control check failures (IaC policy/compliance violations, like misconfigured firewall rules or unencrypted storage buckets) failing in the dev environment.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

What Are the Key Design Considerations When Merging OT and Unmanaged IoT?

S-grade

Which two controls best reduce unauthorized BYOD access risk?

S-grade

Which Sources Best Support SIEM False Positive and Negative Analysis?

A-grade

How Should a Hospital Secure Vendor Remote Access to HVAC?

A-grade

← Back to CA1-005 Study Guide