What separation is required between development and production environments?

What separation is required between development and production environments?

• A. They may share development and production environments with identical access controls.
• B. Separate development/test environments from production environments, and enforce the separation with access controls.
• C. There is no requirement for environment separation.
• D. Development and production must be on separate networks but can share access policies.

Answer: (B)

Maintaining clear separation between development/test and production environments is the main concept being tested. This separation helps prevent untested code, debugging, or sample data from affecting live systems and from exposing production data. Enforcing the separation with access controls means only authorized personnel can enter each environment, with privileges limited to what is necessary for their role. This reduces the risk of changes in development impacting production and strengthens auditability of who accessed which environment and when. This is why the best choice requires separating development/testing from production and tying that separation to access controls. The other options either allow sharing environments or access policies, which undermines the necessary boundaries between development and production.

Maintaining clear separation between development/test and production environments is the main concept being tested. This separation helps prevent untested code, debugging, or sample data from affecting live systems and from exposing production data. Enforcing the separation with access controls means only authorized personnel can enter each environment, with privileges limited to what is necessary for their role. This reduces the risk of changes in development impacting production and strengthens auditability of who accessed which environment and when.

This is why the best choice requires separating development/testing from production and tying that separation to access controls. The other options either allow sharing environments or access policies, which undermines the necessary boundaries between development and production.