2.10 Determine DevSecOps Recommendations (implications) 350-201 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   In a CI/CD pipeline, where should security controls be integrated to best support a 'shift left' approach?

   • AOnly during the post-deployment monitoring phase
   • BAt the very end of the pipeline, just before release
   • COnly in the production environment
   • DAs early as possible, starting from the commit and build stages
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A DevOps team is deploying a containerized application to a Kubernetes cluster. They want to ensure that only trusted images are used and that vulnerabilities are caught before deployment. Which set of controls should they implement?

   • AScan images in the CI pipeline and store them in a private registry without any additional controls.
   • BSign images with a private key, scan images in the CI pipeline, and enforce an admission controller that only allows signed images.
   • CUse a runtime security tool that monitors containers for suspicious activity and alerts the security team.
   • DManually review each image's Dockerfile before it is pushed to the registry.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A team is integrating a new security tool into their CI pipeline. The tool requires a license and has a significant learning curve. The team wants to minimize disruption to the development process. Which approach is BEST?

   • ARun the tool only on a nightly basis and report findings to the security team
   • BSkip the tool and rely on manual security reviews
   • CRun the tool in a non-blocking advisory mode initially, then gradually enforce findings after the team is comfortable
   • DEnforce the tool's findings immediately on all builds
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A team deploys a microservices application to Kubernetes. They want to integrate security into their CI/CD pipeline to reduce the risk of deploying vulnerable containers. Which combination of controls should they implement?

   • ARun DAST against the running application after deployment and monitor runtime logs
   • BScan container images for vulnerabilities in the pipeline and enforce an admission controller that blocks non-compliant images
   • CUse Kubernetes secrets for all configuration and rely on network policies
   • DPerform a manual security review of each container image before deployment
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company is using Terraform to manage cloud infrastructure. They want to ensure that secrets are not stored in plaintext in the Terraform files. Which practice is most effective?

   • ACommit the secrets to the repository but restrict access to the repository.
   • BStore secrets in a secrets management service and reference them in Terraform using variables or data sources.
   • CEncrypt the Terraform files with a password and store the password in the repository.
   • DUse environment variables in the CI pipeline to pass secrets to Terraform.
   Reveal Solution Discussion Select an answer first