ISC2 CISSP Practice Question

DevSecOps specifically extends DevOps by shifting security left-integrating static, dynamic, and dependency scans, policy checks, and compliance gates into each stage of the CI/CD pipeline. Responsibility for security is shared by development, operations, and security teams, reducing late-stage defect discovery. In contrast, traditional DevOps emphasizes rapid delivery and may bolt security on after builds. Waterfall with a gated security review keeps most security testing in a single late phase, increasing risk if defects surface. Scrum is an Agile framework for iterative delivery; while security can be added, it is not an inherent part of the framework. Therefore, the approach that best satisfies the CISO's directive is DevSecOps.