A security team is implementing a DevSecOps culture in their organization. They want to ensure that developers are accountable for security without creating a bottleneck. Which approach best achieves this?

Have the security team review every code change before deployment.

Let developers handle all security without any oversight.

Use only automated security tools and remove human involvement.

Provide security training and tools to developers, and have security teams review critical changes.

A company uses Terraform to manage infrastructure and Kubernetes for container orchestration. They want to ensure that secrets used in both Terraform and Kubernetes are protected. Which approach provides the most secure and centralized solution?

Use separate secrets management for Terraform and Kubernetes.

Store secrets in Terraform state and Kubernetes ConfigMaps.

Use a dedicated secrets management tool like HashiCorp Vault.

Embed secrets in the Terraform code and Kubernetes manifests.

What is the primary purpose of integrating automated security scanning into a CI/CD pipeline?

To identify vulnerabilities early in the development process, when they are cheaper and easier to fix

To provide a record of all code changes for compliance audits only

To replace the need for manual code reviews by developers

To ensure that all code changes are automatically deployed to production without human approval

A developer is writing code that handles user input in a web application. They want to prevent SQL injection attacks. Which secure coding practice should they follow?

Use dynamic SQL with string formatting.

Concatenate user input directly into SQL strings.

Use parameterized queries or prepared statements.

Disable error messages on the database.

A DevOps team uses Terraform to provision cloud resources. Which practice is most directly associated with securing infrastructure as code?

Using the cloud provider's web console to manually review all resources after deployment

Disabling version control for Terraform files to prevent unauthorized changes

Encrypting the Terraform state file with a passphrase stored in the source code repository

Running static analysis on the Terraform templates to detect misconfigurations before deployment

CiscoCertified Network Professional Security

Domain 3Objective 7

3.7 Describe DevSecOps (Infrastructure as Code Security, CI/CD Pipeline, Container Orchestration, and Secure Software Development) 350-701 Practice Questions (Page 4)

Part of the Cloud Security domain, which accounts for 15% of the 350-701 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–2 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

4concepts

15%of the exam

Questions 16–20

16expert · hard
A security team is implementing a DevSecOps culture in their organization. They want to ensure that developers are accountable for security without creating a bottleneck. Which approach best achieves this?
Select an answer first
17expert · hard
A company uses Terraform to manage infrastructure and Kubernetes for container orchestration. They want to ensure that secrets used in both Terraform and Kubernetes are protected. Which approach provides the most secure and centralized solution?
Select an answer first
18foundation · easy
What is the primary purpose of integrating automated security scanning into a CI/CD pipeline?
Select an answer first
19application · medium
A developer is writing code that handles user input in a web application. They want to prevent SQL injection attacks. Which secure coding practice should they follow?
Select an answer first
20foundation · easy
A DevOps team uses Terraform to provision cloud resources. Which practice is most directly associated with securing infrastructure as code?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-701

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-701” is a trademark of its owner, used for identification only.