Separating development, testing and production environments

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which approach follows environment separation?

A Developers build and test using dummy data in the development environment

B Developers copy the live customer database into development to test with real data

2. Who should normally have access to the production environment?

A Every developer on the team, so they can fix problems quickly

B Only a few authorised staff who need it for their role

3. How should new code reach production?

A It is tested in the testing environment, approved, then promoted to production

B The developer uploads it straight from their laptop to production when it seems to work

4. A hacker steals a developer's login for the development environment. With separate environments, what is the likely result?

A The breach is contained, because the hacker cannot reach production or live data

B The hacker can reach production and live data just as easily as development

5. Which statement about separated environments is true?

A One shared login gives access to all three environments

B Each environment has its own access controls

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1DEV_DB = "dev_sample_data"		ADEV_KEY != TEST_KEY != PROD_KEY
2PROD_ACCESS = ["ops_lead", "sys_admin"]		BOnly a small, named group can access production, so access to the live environment is restricted and controlled separately
3Code is promoted from development to testing to production only after it passes checks and is approved		Cif tests_passed and approved: deploy("production")
4Each environment has its own separate credentials, so a breach in one cannot be used to get into another		DCopies live customer data into the development environment, so real personal data is exposed to developers and mixes with untested code. Use sample or anonymised data instead.
5dev_db.copy_from("production_customers")		EDeploys untested development code straight to production, skipping testing and approval. Code should be promoted step by step through a controlled process.
6git push origin dev --deploy-to=production		FThe development environment uses fake or sample data, so no live customer data is exposed while developers work

Definitions

Environment separation

Fill in the Blanks

Complete each line of code by filling in the missing parts.

IF environment = "___________" THEN data ← sampleData

IF userRole = "_________" THEN productionAccess ← FALSE

IF testsPassed ___ approvedByLead THEN deploy(build, "production")

IF breachIn = "development" THEN productionExposed ← _____

ASSERT ___ (devDbHost = prodDbHost)

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A env ← 'dev'

B db ← 'live_students.db'

C load(db)

Question 2

A role ← user.role

B IF env = 'production' THEN

C allow ← TRUE

D END IF

Question 3

A runUnitTests(build)

B IF allTestsPassed = FALSE THEN

C promote(build, 'testing')

Question 4

A dev.key ← 'KEY_DEV_91'

B test.key ← 'KEY_TEST_47'

C prod.key ← dev.key

Question 5

A IF env = 'production' THEN

B data ← loadSampleData()

C ELSE

D data ← loadLiveData()

Answer Key

Separating development, testing and production environments

Section A: Quick Questions

A — Developers build and test using dummy data in the development environment

B — Only a few authorised staff who need it for their role

A — It is tested in the testing environment, approved, then promoted to production

A — The breach is contained, because the hacker cannot reach production or live data

B — Each environment has its own access controls

Section B: Match the Pairs

DEV_DB = "dev_sample_data" → The development environment uses fake or sample data, so no live customer data is exposed while developers work

PROD_ACCESS = ["ops_lead", "sys_admin"] → Only a small, named group can access production, so access to the live environment is restricted and controlled separately

Code is promoted from development to testing to production only after it passes checks and is approved → if tests_passed and approved: deploy("production")

Each environment has its own separate credentials, so a breach in one cannot be used to get into another → DEV_KEY != TEST_KEY != PROD_KEY

dev_db.copy_from("production_customers") → Copies live customer data into the development environment, so real personal data is exposed to developers and mixes with untested code. Use sample or anonymised data instead.

git push origin dev --deploy-to=production → Deploys untested development code straight to production, skipping testing and approval. Code should be promoted step by step through a controlled process.

Section C: Definitions

Environment separation — Keeping development, testing and production apart so untested code and live data never mix, and access to each is controlled separately. It also helps contain a breach.

Section D: Fill in the Blanks

IF environment = "development" THEN
    data ← sampleData

IF userRole = "developer" THEN
    productionAccess ← FALSE

IF testsPassed AND approvedByLead THEN
    deploy(build, "production")

IF breachIn = "development" THEN
    productionExposed ← FALSE

ASSERT NOT (devDbHost = prodDbHost)

Section E: Spot the Error

B — The development environment must never use live data. It should load fake or dummy data, such as 'fake_students.db', not the live student records.

C — Access to production must be restricted to specific authorised roles. Setting allow to TRUE gives everyone access. It should check for a role such as 'ops_admin'.

B — Code should only be promoted to the next environment once its tests pass. The condition is inverted, so failing code would be promoted. It should be IF allTestsPassed THEN.

C — Each environment needs its own separate credentials. If production reuses the dev key, a breach of development also exposes production. Production should have its own key.

A — Sample data belongs in development, and live data only in production. With this condition, production would get sample data and development would get live data. It should check for 'development'.