Secure Software Development Lifecycle (SDLC) in the Cloud CSE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A traditional waterfall development team is transitioning to a cloud-native environment. They want to adopt a more agile SDLC that supports continuous delivery. Which change to the SDLC is MOST appropriate for cloud?

   • ADeploy directly to production without staging to speed up releases.
   • BEliminate the testing phase entirely because the cloud provider handles security.
   • CUse short development cycles with automated testing and deployment pipelines.
   • DKeep the same waterfall phases but move them to the cloud to reduce infrastructure costs.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company is adopting immutable infrastructure for its cloud deployment. They want to ensure that any change to the application or its configuration is made by deploying a new version rather than modifying the existing one. Which practice BEST supports this?

   • AUse a configuration management tool to apply updates to running servers.
   • BUse a patch management tool to install security updates on the running instances.
   • CBuild a new machine image from a pipeline and replace the existing instances in a rolling update.
   • DAllow administrators to SSH into production servers to fix issues quickly.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security team wants to integrate security testing into their CI/CD pipeline for a containerized application. They need to catch vulnerabilities in the application's source code and in the container image itself before deployment. Which combination of testing tools should they use?

   • ASAST on the source code and container image scanning for known vulnerabilities.
   • BIAST during runtime and manual code review.
   • CA single SAST tool configured to scan both source code and container images.
   • DDAST against the running application and penetration testing after deployment.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which tool or practice is commonly used in DevSecOps to automate security checks in a CI/CD pipeline?

   • AManual code review by a security expert
   • BDisabling security checks to speed up the pipeline
   • CPost-deployment penetration testing only
   • DAutomated SAST scanning integrated into the build process
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A development team is designing a microservices-based application on Kubernetes. They need to ensure that if one microservice is compromised, the attacker cannot easily move laterally to other services. Which design principle should be applied?

   • AImplement network policies that restrict traffic between pods to only the required paths.
   • BDeploy all microservices in the same namespace to reduce management overhead.
   • CUse a single shared service account for all microservices to simplify authentication.
   • DExpose all microservices through a single public load balancer without internal segmentation.
   Reveal Solution Discussion Select an answer first