3.7 Describe DevSecOps (Infrastructure as Code Security, CI/CD Pipeline, Container Orchestration, and Secure Software Development) 350-701 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A team uses CloudFormation to deploy AWS resources. They want to automatically check the template for security misconfigurations before deployment. Which tool should they integrate into their CI/CD pipeline?

   • ACheckov
   • BAWS Config
   • CCloudTrail
   • Dcfn-lint
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A Kubernetes cluster hosts multiple microservices. The security team wants to restrict traffic so that only the frontend service can communicate with the backend service. Which Kubernetes resource should they use?

   • ARoleBinding
   • BNetworkPolicy
   • CPodSecurityPolicy
   • DConfigMap
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is a recommended practice for handling secrets (such as API keys) in infrastructure as code?

   • AEmbed secrets directly in the IaC templates for simplicity and ease of use
   • BStore secrets in a dedicated secrets management service and reference them dynamically
   • CUse the same secret across all environments to reduce management overhead
   • DEncrypt the IaC templates with a key stored in the same repository
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A DevOps team uses Terraform to deploy Azure resources. They want to enforce tagging and resource naming conventions before any resource is created. Which approach should they use?

   • AUse Azure Policy with the Terraform provider to audit and enforce tags and naming conventions during deployment.
   • BAdd a pre-commit hook that checks the Terraform files for tag attributes.
   • CRun a custom script in the pipeline that parses the Terraform plan output and fails the build if tags are missing.
   • DConfigure the Terraform backend to store state in an encrypted storage account and enable versioning.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security team wants to ensure that only approved container images are deployed to their Kubernetes cluster. Which control should they implement?

   • AManually review all images before deployment.
   • BDisable the container registry.
   • CUse an admission controller to validate image signatures.
   • DScan images only after deployment.
   Reveal Solution Discussion Select an answer first