2.10 Determine DevSecOps Recommendations (implications) 350-201 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which statement best describes a core principle of DevSecOps?

   • ASecurity is performed by a separate team after the development phase is complete.
   • BSecurity is limited to the production environment and applied only during deployment.
   • CSecurity is the sole responsibility of the security operations center (SOC).
   • DSecurity is integrated as early as possible and automated throughout the software delivery lifecycle.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company has adopted a DevSecOps model with automated deployments. A security incident occurs in a production environment. How does the DevSecOps approach most directly improve the incident response process?

   • AIt eliminates the need for a dedicated incident response team because security is integrated into the pipeline.
   • BIt requires the incident response team to manually review every code change before responding.
   • CIt guarantees that no security incident can occur because of continuous security testing.
   • DIt enables faster rollback to a previous known-good version because deployments are automated and versioned.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company must comply with a regulation that requires all infrastructure changes to be logged and reviewed. They are using IaC and a CI/CD pipeline. They want to automate the logging and review process as much as possible. Which approach is most effective?

   • AHave the security team manually review every change after it is deployed.
   • BUse a configuration management database (CMDB) to log all changes and have the security team review the CMDB weekly.
   • CUse a version control system for IaC templates and require pull request approvals, with automated policy checks in the pipeline.
   • DUse a script that sends an email to the security team after every deployment.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A Kubernetes cluster is running multiple microservices. The security team wants to detect and respond to runtime threats, such as a container attempting to execute a shell inside another container. Which control is most appropriate?

   • ARun a SAST scan on the microservices' source code before deployment.
   • BUse a network policy to restrict traffic between pods.
   • CEnable Kubernetes audit logging and review logs manually.
   • DDeploy a runtime security agent (e.g., Falco) that monitors syscalls and container behavior and alerts on suspicious activity.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A regulated industry company must demonstrate to auditors that all infrastructure changes are reviewed and approved before deployment. They are adopting IaC and CI/CD. Which approach best satisfies this requirement?

   • AHave the security team manually approve every change after it is deployed.
   • BImplement a policy-as-code solution that automatically checks IaC templates against compliance rules and requires a pull request approval before merging.
   • CUse a configuration management tool to enforce the desired state and log any drift.
   • DStore all IaC templates in a shared folder and require a sign-off via email.
   Reveal Solution Discussion Select an answer first