2.10 Determine DevSecOps Recommendations (implications) 350-201 Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is a primary security measure for container images in a DevSecOps pipeline?

   • ARunning containers with root privileges by default
   • BStoring container images in a public registry without access controls
   • CDisabling all logging inside containers
   • DScanning images for known vulnerabilities before deployment
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is a key implication of shifting security left in a CI/CD pipeline?

   • ASecurity issues are identified earlier, reducing the cost and effort to fix them.
   • BSecurity testing is eliminated because code is reviewed manually.
   • CSecurity is only applied to the final release artifact.
   • DSecurity teams must manually approve every code change.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company is adopting Infrastructure as Code (IaC) to manage its cloud environment. The security team wants to ensure that no insecure configurations are deployed. They also need to maintain an audit trail of changes. Which combination of controls best meets these requirements?

   • APerform manual code reviews of every IaC change before merging, and store the templates in a shared network drive.
   • BUse a configuration management database (CMDB) to track deployed resources and manually update it after each change.
   • CScan the production environment after deployment with a cloud security posture management tool and alert on misconfigurations.
   • DRun a static analysis scanner on IaC templates in the CI pipeline and store the templates in a version-controlled repository.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A company is building a DevSecOps pipeline and needs to choose between two security tools: one that integrates deeply with their existing CI/CD platform but has limited coverage for their technology stack, and another that has broad coverage but requires significant custom integration. Which factor should be the primary consideration?

   • AThe tool's user interface and reporting capabilities.
   • BThe tool's ability to cover the organization's specific technology stack and provide accurate results.
   • CThe tool's ease of integration with the existing CI/CD platform.
   • DThe tool's cost and licensing model.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security team is being integrated into a DevOps team. The developers are resistant to security checks because they feel it slows down their delivery. Which action best aligns with DevSecOps principles to address this resistance?

   • ACreate a separate security gate at the end of the pipeline that must be approved by the security team.
   • BHave the security team perform a full penetration test after every release.
   • CRequire developers to manually run a security checklist before every release.
   • DInvolve security engineers in the development process and automate security checks so they are fast and provide clear feedback.
   Reveal Solution Discussion Select an answer first