2.10 Determine DevSecOps Recommendations (implications) 350-201 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company has a DevSecOps pipeline that automatically deploys to production. A critical vulnerability is discovered in a third-party library used by the application. What is the fastest way to remediate this using DevSecOps practices?

   • AWait for the library vendor to release a patch and then manually install it on each server.
   • BDisable the application until the library is updated.
   • CManually patch the library on all production servers and then update the source code.
   • DUpdate the library version in the source code, commit the change, and let the CI/CD pipeline automatically build, test, and deploy the fix.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A team uses Ansible to provision servers. They want to ensure that no secrets are stored in plain text in their playbooks and that only authorized users can modify the playbooks. Which two controls should they implement?

   • AEncrypt the entire repository with a single password shared among all developers
   • BUse environment variables for all secrets and disable code review
   • CUse Ansible Vault to encrypt secrets and enforce branch protection with required reviews on the playbook repository
   • DStore secrets in a public GitHub repository and rely on repository privacy
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company runs a containerized application in production. They want to detect and respond to runtime threats, such as unauthorized processes or file access, inside containers. Which control should they add to their DevSecOps toolchain?

   • ADeploy a container runtime security tool that monitors system calls and enforces a security policy
   • BRun SAST on the container image source code
   • CPerform a vulnerability scan on the container image before deployment
   • DUse a network firewall to block all inbound traffic to the container
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company deploys code to production multiple times per day. They want to improve their incident response capabilities to detect and respond to security issues faster. Which DevSecOps practice would be MOST effective?

   • ADisable automated deployments until a security incident is resolved
   • BImplement automated monitoring and alerting on production systems, and use infrastructure as code to rebuild environments quickly
   • CRely on the security team to manually check logs after an incident is reported
   • DConduct a full security review of the codebase once a quarter
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A security team is evaluating a new SAST tool to integrate into their CI pipeline. The tool has a high false-positive rate, and developers are ignoring its findings. The team wants to improve developer adoption while maintaining security coverage. Which approach is BEST?

   • ABlock all builds that have any SAST finding
   • BRun SAST only on release branches and ignore findings in feature branches
   • CReplace SAST with DAST to reduce false positives
   • DTune the SAST tool's rules to reduce false positives and provide developers with clear remediation guidance
   Reveal Solution Discussion Select an answer first