Code Security and CI/CD Integration
What this domain tests
This domain tests how Prisma Cloud Code Security scans infrastructure as code, repositories, and secrets, and how CI/CD integrations enforce build policies. You need to know where scanning happens and how failures reach developers.
Core rules and concepts
- Code Security scans IaC templates such as Terraform, CloudFormation, Kubernetes YAML, and ARM templates, plus repository secrets.
- CI/CD integrations connect GitHub, GitLab, Bitbucket, Azure DevOps, and Jenkins to scan pull requests and builds.
- Build policies can fail a pipeline or post PR comments when a violation is found.
- Code-to-cloud context links a code finding to deployed cloud resources where supported.
- Secrets detection should cover current files and repository history where configured.
Worked example
A GitHub pull request adds an S3 bucket with a public ACL. Reasoning: the CI/CD integration scans the Terraform diff, matches an IaC policy, and posts a PR comment. If the build policy is set to block, the pipeline fails before merge. The developer fixes the ACL, reruns the check, and the policy passes.
Traps that cost marks
Do not rely on runtime scanning to catch IaC defects before deployment. Do not assume a PR comment alone blocks a merge; branch protection and build-policy enforcement matter. Do not ignore secrets already present in history. Do not forget that CI/CD credentials need least privilege.