Secure Deployment and Maintenance
Domain 10: Secure Deployment and Maintenance
This domain tests whether security survives release and operations. The exam expects hardened environments, protected secrets, controlled pipelines, dependency management, monitoring, and patching.
Core rules and concepts
- Separate development, test, and production environments. Do not use production data or production secrets in lower environments.
- Harden hosts and runtime configuration: remove defaults, disable debug modes, close unused ports, enforce TLS, and run services with least privilege.
- Store secrets in a secrets manager or equivalent, inject them at runtime, restrict access, and rotate them. Never commit secrets to source control.
- Secure the CI/CD pipeline with reviewed changes, protected branches, artifact integrity, and security gates for SAST, dependency scanning, and container scanning.
- Maintain an inventory of dependencies and versions. Monitor for vulnerabilities, patch on a risk-based schedule, and remove unsupported components.
- Monitor security events, retain logs appropriately, back up data, test restoration, and maintain an incident response path.
Worked example
A deployment script contains the production database password and runs the application as a highly privileged account. A sound deployment retrieves the credential from a secrets manager at runtime, uses a database account limited to the required schema and operations, enables TLS, and gates the release on dependency and container scans. After deployment, a DAST scan runs against a staging environment with credentials. The reasoning is that secret removal reduces credential theft, least privilege limits blast radius, scanning catches known issues, and staging preserves production safety.
Traps that cost marks
Do not leave debug mode or default accounts enabled in production. Do not store secrets in environment files committed to a repository. Do not ignore transitive dependencies. Do not deploy unreviewed artifacts. Do not treat deployment as the end of security work.
Review habit
For each release, confirm configuration baseline, secret source, dependency status, scan results, rollback plan, and monitoring coverage.