How to Reduce IaC Deployment Failures in a CI/CD Pipeline?
A company updates its cloud-based services by saving infrastructure code in a remote repository. The code is automatically deployed into the development environment every time the code is saved to the repository. The developers express concern that the deployment often fails, citing minor code issues and occasional security control check failures in the development environment. Which of the following should a security engineer recommend to reduce the deployment failures? (Choose two.)
Community Insight
The question tests whether you can map each symptom to a shift-left control: linting for code quality and compliance scanning for IaC policy violations. The common trap is choosing broad deployment safeguards such as regression testing or branch protection that do not catch either failure type.
Pre-commit code linting and pipeline compliance scanning address the two failure classes in this scenario: minor code defects and IaC security-control violations. Together they shift validation left, before the automated development deployment runs.
Many learners pick automated regression testing or repository branch protection because they sound like deployment safeguards, but neither catches syntax errors, malformed YAML/JSON, or IoC policy violations before the pipeline deploys them.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Pre-commit code linting directly targets the first symptom: minor code issues that cause frequent build crashes. Linting validates syntax, formatting, and template structure such as YAML/JSON before the code is committed, so malformed infrastructure code never reaches the deployment stage. Pipeline compliance scanning targets the second symptom: security control check failures in the development environment, because it evaluates IaC against policy and compliance rules before deployment. As BWH9492 summarized, the stem separates "Minor code issues (syntax errors, formatting flaws, malformed YAML/JSON templates)" from "Security control check failures" such as misconfigured firewall rules or unencrypted storage buckets. Choosing B and F therefore gives one control per failure class and moves detection earlier in the CI/CD pipeline.Why the Other Options Are Wrong
Software composition analysis examines third-party dependencies for known vulnerabilities; it does not lint first-party code or enforce IaC security policy. Repository branch protection limits who can push or merge, but it does not validate the content of the code, so syntax errors and policy violations still pass through. Automated regression testing runs after a build or deployment and checks functional behavior, which is too late and too broad to prevent minor template defects or security-control failures. A code submit authorization workflow adds human approval but does not automatically detect linting errors or compliance violations in the infrastructure code.Community Comment Notes
BWH9492 frames the scenario as two distinct problems, which supports selecting one control for code quality and one for security compliance rather than a single broad safeguard. That framing is consistent with the shift-left intent of the question: catch defects at commit time and catch policy violations before deployment. The comment's examples of misconfigured firewall rules and unencrypted storage buckets align with what pipeline compliance scanning is designed to flag. This makes B and F the most defensible pair.Official Reference
Exam Strategy
When a stem separates 'code issues' from 'security control check failures,' look for one control per symptom. Eliminate options that operate after deployment, such as regression testing, or only govern who can merge, such as branch protection.
Frequently Asked Questions
Why isn't automated regression testing enough to prevent these deployment failures?
Regression testing validates behavior after a build; it does not catch syntax errors in IaC templates or policy violations before the pipeline deploys them.
Does repository branch protection reduce IaC deployment failures?
No. Branch protection controls who can merge code, but it does not lint the templates or scan them for security-control violations.