2.10 Determine DevSecOps Recommendations (implications) 350-201 Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   What is a recommended approach for managing secrets in Infrastructure as Code (IaC)?

   • AUsing a dedicated secrets management service and referencing it in IaC
   • BHardcoding secrets in the source code repository
   • CEmbedding secrets as plaintext variables in the IaC files
   • DSharing secrets via email to team members
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A company runs a Kubernetes cluster with multiple namespaces for different teams. They want to enforce that only images from their private registry can be deployed, and that all images are scanned for vulnerabilities. Which combination of controls is MOST effective?

   • AUse network policies to restrict egress from the cluster
   • BUse Kubernetes secrets to store registry credentials and rely on RBAC
   • CRun a vulnerability scanner only on the CI pipeline and trust that all images are scanned
   • DUse an admission controller to validate image registry and enforce a policy that blocks images with critical vulnerabilities
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A company is deploying a containerized application to a Kubernetes cluster. They have a strict compliance requirement that all images must be scanned for vulnerabilities and only images with no critical vulnerabilities can be deployed. However, the development team wants to be able to deploy quickly for testing. Which approach balances security and speed?

   • ABlock all deployments until the security team manually approves each image.
   • BRequire all images to be signed and only allow signed images to be deployed, without scanning.
   • CScan images in the CI pipeline and block deployment if critical vulnerabilities are found, but allow non-critical vulnerabilities with a risk acceptance process.
   • DScan images only in the production environment and alert the security team if critical vulnerabilities are found.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A development team is adopting DevSecOps and wants to catch security defects as early as possible in the CI/CD pipeline. They currently run unit tests and build the application in the pipeline, but they have no security testing. Which two security testing types should they add FIRST to achieve the earliest feedback?

   • AContainer image scanning and runtime monitoring
   • BIAST and penetration testing
   • CSAST and dependency scanning
   • DDAST and RASP
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A healthcare organization must demonstrate compliance with data protection regulations. They want to automate compliance checks in their CI/CD pipeline. Which approach is MOST effective?

   • ADeploy to production first and then run compliance scans
   • BIntegrate a policy-as-code engine that evaluates infrastructure and application code against regulatory controls before deployment
   • CConduct a manual compliance audit after every release
   • DUse a spreadsheet to track compliance requirements and check them off manually
   Reveal Solution Discussion Select an answer first