Secure Software Development Lifecycle (SDLC) in the Cloud CSE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company is moving from a traditional on-premises SDLC to a cloud-based one. They want to adopt a more agile and automated approach. Which change is most characteristic of adapting the SDLC to the cloud?

   • AMoving all testing to manual processes to avoid automation complexity
   • BIncreasing the length of the testing phase to ensure quality
   • CIntegrating security checks into automated CI/CD pipelines
   • DReducing the number of development iterations to save costs
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company is adopting DevSecOps and wants to automate security checks in their CI/CD pipeline. They have a mix of legacy and cloud-native applications. The security team wants to enforce security policies without slowing down development. Which approach best balances security and speed?

   • AAutomate security checks but only run them on a nightly basis to avoid impacting the pipeline.
   • BDisable security checks in the pipeline and rely on post-deployment monitoring.
   • CRun all security checks manually before each release to ensure thorough review.
   • DAutomate security checks in the pipeline and fail the build on critical findings, while allowing non-critical findings to be tracked as technical debt.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which activity ensures that a cloud SDLC process aligns with regulatory compliance requirements?

   • ARelying solely on the cloud provider's compliance certifications
   • BConducting regular compliance audits and assessments
   • CStoring compliance documentation in a shared public repository
   • DIgnoring compliance until the final deployment
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A cloud application is experiencing a security incident. The security team needs to determine the scope of the breach and preserve evidence. Which operational practice is MOST important during the incident response phase?

   • AEnable verbose logging for all services and retain logs for a defined period.
   • BImmediately delete the affected instances to prevent further damage.
   • CNotify the cloud provider and ask them to disable the account.
   • DTake snapshots of affected instances and collect logs before any cleanup or remediation.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   During the requirements phase of a cloud application, which security requirement is specifically important due to the shared responsibility model?

   • ASelecting a programming language that is immune to all vulnerabilities
   • BGuaranteeing the application will never experience downtime
   • CEnsuring the application is compatible with all web browsers
   • DDefining which security controls are the responsibility of the cloud provider versus the customer
   Reveal Solution Discussion Select an answer first