Exam CAS-004 topic 1 question 208 discussion

Actual exam question from CompTIA's CAS-004

Question #: 208
Topic #: 1

An enterprise is undergoing an audit to review change management activities when promoting code to production. The audit reveals the following:

• Some developers can directly publish code to the production environment.
• Static code reviews are performed adequately.
• Vulnerability scanning occurs on a regularly scheduled basis per policy.

Which of the following should be noted as a recommendation within the audit report?

A. Implement short maintenance windows.
B. Perform periodic account reviews.
C. Implement job rotation.
D. Improve separation of duties.

Show Suggested Answer

Suggested Answer: D 🗳️

by Serliop378 at March 9, 2023, 3:50 p.m.

Comments

Submit Cancel

BiteSize

Highly Voted 11 months, 1 week ago

Selected Answer: D

The question highlights one problem, some devs have more permissions than necessary. The only option that addresses that is improving a control already in place. Performing a review doesn't mean any action will take place. (semantics of words at this point) Source: Verifying each answer against Chat GPT, my experience, other test banks, a written book, and weighing in the discussion from all users to create a 100% accurate guide for myself before I take the exam. (It isn't easy because of the time needed, but it is doing my diligence)

upvoted 5 times

...

Chiaretta

Most Recent 5 months ago

Selected Answer: B

I think the right answer is "Job rotation"

upvoted 1 times

...

Serliop378

1 year, 3 months ago

Selected Answer: D

Some dev can push the code in the pipeline/main branch so separation of duties need to be enforced for all devs

upvoted 3 times

...