How can compliance policies be enforced in an automated DevSecOps workflow?

By documenting policies in a wiki without enforcement

By relying on manual audits after each release

By allowing developers to self-certify compliance

By embedding policy checks as automated gates in the CI/CD pipeline

Which capability is essential for runtime protection in a Kubernetes cluster?

Monitoring container activity for anomalous behavior

Removing all resource limits to improve performance

Allowing containers to run with privileged security contexts

Disabling network policies to simplify traffic flow

A company has a DevSecOps pipeline that automatically deploys to production. A security incident occurs, and the incident response team needs to understand what changed in the environment. Which source of information is most useful?

The network firewall logs from the production environment.

The system administrator's manual notes about changes.

The version control system's commit history and the CI/CD pipeline's deployment logs.

The container image registry's list of images.

Which DevSecOps practice supports faster incident recovery?

Using infrastructure as code to rebuild environments quickly

Keeping manual runbooks that are rarely updated

Avoiding version control for configuration files

Storing backups only on the same server as the application

A web application team wants to add automated security testing to their CI/CD pipeline. They need to test the application's behavior at runtime, including authentication and authorization logic, but they do not have the ability to instrument the application code. Which type of testing should they use?

DAST (Dynamic Application Security Testing)

SAST (Static Application Security Testing)

IAST (Interactive Application Security Testing)

RASP (Runtime Application Self-Protection)

CiscoCertified Network Professional Cybersecurity (CBRCOR)

Domain 2Objective 10

2.10 Determine DevSecOps Recommendations (implications) 350-201 Practice Questions (Page 8)

Part of the Techniques domain, which accounts for 30% of the 350-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 1–1 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

8concepts

30%of the exam

Questions 36–40

36foundation · easy
How can compliance policies be enforced in an automated DevSecOps workflow?
Select an answer first
37foundation · easy
Which capability is essential for runtime protection in a Kubernetes cluster?
Select an answer first
38expert · hard
A company has a DevSecOps pipeline that automatically deploys to production. A security incident occurs, and the incident response team needs to understand what changed in the environment. Which source of information is most useful?
Select an answer first
39foundation · easy
Which DevSecOps practice supports faster incident recovery?
Select an answer first
40application · medium
A web application team wants to add automated security testing to their CI/CD pipeline. They need to test the application's behavior at runtime, including authentication and authorization logic, but they do not have the ability to instrument the application code. Which type of testing should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-201” is a trademark of its owner, used for identification only.