Which practice helps ensure separation of duties between development and production environments?

Which practice helps ensure separation of duties between development and production environments?

• A. Use of production data in test with masking
• B. Separation of duties between development/test and production environments
• C. Centralized admin access to production
• D. No access controls

Answer: (B)

Separating development/testing from production creates a boundary where changes must pass through independent review and controlled processes before reaching live systems. This separation means the people who write or test code are not the ones who directly deploy or operate it in production, so no single person can both create and authorize production changes. That supports proper change management, access controls, and audit trails, which together reduce the risk of accidental or intentional changes affecting production and help protect sensitive data and system availability. Using production data in a test environment with masking addresses data protection, not the enforcement of environment boundaries. Centralizing admin access to production undermines separation by concentrating control in one group, increasing risk. Having no access controls makes separation ineffective altogether.

Separating development/testing from production creates a boundary where changes must pass through independent review and controlled processes before reaching live systems. This separation means the people who write or test code are not the ones who directly deploy or operate it in production, so no single person can both create and authorize production changes. That supports proper change management, access controls, and audit trails, which together reduce the risk of accidental or intentional changes affecting production and help protect sensitive data and system availability.

Using production data in a test environment with masking addresses data protection, not the enforcement of environment boundaries. Centralizing admin access to production undermines separation by concentrating control in one group, increasing risk. Having no access controls makes separation ineffective altogether.