A DevSecOps team is selecting security tools to integrate into their CI/CD pipeline. They want to minimize the number of tools while covering source code analysis, dependency scanning, and container image scanning. Which approach is MOST appropriate?

Select best-of-breed tools for each function and integrate them individually

Use a single vendor's security suite that provides SAST, dependency scanning, and container image scanning, and integrate it via a common plugin

Implement a custom script to perform all three types of scanning

Use only a container image scanner and rely on it for all security testing

A financial services company must ensure that every code change is reviewed, tested, and approved before production deployment. They are adopting DevSecOps and want to automate compliance checks without slowing down development. Which approach BEST meets their requirement?

Use a single pipeline that automatically deploys to production after all tests pass, with no human approval

Require a security team to manually review every pull request and approve all deployments

Perform a full penetration test after every production deployment

Implement a CI/CD pipeline with automated SAST, unit tests, and a policy-as-code gate that requires an authorized approval before production

A company is adopting IaC and wants to enforce that all cloud resources have specific tags for cost allocation and compliance. They also want to prevent any resource from being created without these tags. Which approach is most effective?

Use a policy-as-code tool (e.g., Open Policy Agent) to validate IaC templates before deployment and reject any that do not include the required tags.

Manually review every IaC template before deployment to ensure tags are present.

Use a script that runs after deployment to find untagged resources and add the required tags.

Use a cloud provider's native tagging policy that automatically adds tags to resources after creation.

How does DevSecOps improve incident detection?

By relying solely on manual code reviews

By integrating security monitoring and logging into the delivery pipeline

By performing incident detection only after user complaints

By disabling logging to reduce noise

CiscoCertified Network Professional Cybersecurity (CBRCOR)

Domain 2Objective 10

2.10 Determine DevSecOps Recommendations (implications) 350-201 Practice Questions (Page 3)

Part of the Techniques domain, which accounts for 30% of the 350-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 1–1 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

8concepts

30%of the exam

Questions 11–15

11application · medium
A DevSecOps team is selecting security tools to integrate into their CI/CD pipeline. They want to minimize the number of tools while covering source code analysis, dependency scanning, and container image scanning. Which approach is MOST appropriate?
Select an answer first
12application · medium
A financial services company must ensure that every code change is reviewed, tested, and approved before production deployment. They are adopting DevSecOps and want to automate compliance checks without slowing down development. Which approach BEST meets their requirement?
Select an answer first
13foundation · easy
Which automated security testing type is designed to protect an application by monitoring and blocking attacks at runtime?
Select an answer first
14expert · hard
A company is adopting IaC and wants to enforce that all cloud resources have specific tags for cost allocation and compliance. They also want to prevent any resource from being created without these tags. Which approach is most effective?
Select an answer first
15foundation · easy
How does DevSecOps improve incident detection?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-201” is a trademark of its owner, used for identification only.