2.10 Determine DevSecOps Recommendations (implications) 350-201 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company manages its cloud infrastructure using Terraform. They want to enforce that all S3 buckets are private and that no hard-coded secrets are committed. Which approach BEST addresses these requirements in a DevSecOps pipeline?

   • AEnable AWS Config rules to automatically remediate non-compliant S3 buckets
   • BUse a cloud security posture management tool that monitors the live environment
   • CRun a policy-as-code tool like OPA or Checkov on every Terraform plan and a secret scanner on the repository
   • DRequire all developers to manually review Terraform code before merging
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security team is evaluating a new SAST tool to integrate into their CI/CD pipeline. The tool has a high false-positive rate, and developers are already complaining about alert fatigue. The team wants to reduce the noise without missing critical vulnerabilities. Which approach is most effective?

   • ADisable all warnings and only show errors.
   • BConfigure the tool to only report issues that match a custom rule set tuned to the organization's technology stack and risk tolerance.
   • CRun the tool only on a nightly basis and send the full report to the security team.
   • DHave developers manually triage every finding and mark false positives.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A multinational company must comply with data residency requirements that prohibit certain data from leaving a specific country. They are adopting DevSecOps and want to automate compliance checks. Which approach is BEST?

   • AConduct a manual review of all infrastructure changes to ensure data stays in the country
   • BUse a cloud provider's global load balancer to route traffic to the nearest region
   • CUse a VPN to connect all cloud regions and rely on encryption
   • DUse policy-as-code to enforce that infrastructure is deployed only in approved regions and that data storage services are configured with region constraints
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A team wants to add automated security testing to their CI pipeline. They have a web application with a REST API and want to test for vulnerabilities like SQL injection and XSS. Which testing type is MOST appropriate for this purpose?

   • ARASP
   • BDAST
   • CIAST
   • DSAST
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company experiences a security incident in a Kubernetes cluster. They use GitOps with ArgoCD to manage deployments. What is the BEST way to respond and recover?

   • AManually delete all pods and let Kubernetes recreate them
   • BDisable ArgoCD and manually apply a known-good YAML file
   • CRevert the Git repository to the last known-good commit and let ArgoCD automatically roll back the cluster
   • DTake a snapshot of the cluster and restore it from backup
   Reveal Solution Discussion Select an answer first