Continuous Integration Tools DSE Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A DevSecOps team is integrating a container image scanner into their CI pipeline. They want to ensure that the scanner runs on the exact image that will be deployed, and they want to fail the build if any critical vulnerability is found. They also want to avoid scanning the same image multiple times. Which approach should they use?

   • AScan the image after pushing it to the registry, and if critical vulnerabilities are found, delete the image.
   • BScan the Dockerfile for vulnerabilities before building the image.
   • CScan the image only on the release branch, not on every commit.
   • DBuild the image, scan it, and then push it to the registry only if the scan passes.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A team's CI pipeline is failing intermittently because a flaky test sometimes fails due to network timeouts. Developers are tempted to rerun the build until it passes. Which approach is the best long-term practice?

   • AAdd a retry mechanism that automatically reruns the failed test up to three times before failing the build.
   • BIncrease the pipeline timeout so the test has more time to pass.
   • CInvestigate the flaky test, fix the underlying network dependency or make the test more robust, and then rerun the pipeline.
   • DDisable the flaky test from the pipeline to make the build green.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A development team wants to enforce that no pull request can be merged if the CI pipeline finds a high-severity vulnerability in the application's dependencies. They use GitHub Actions for CI. Which configuration best achieves this?

   • AUse a GitHub Action that uploads the dependency report to a security dashboard for manual review.
   • BConfigure the repository to require a code review from a security team before merging.
   • CAdd a CI job that runs 'npm audit' (or equivalent) and fails the build if a high-severity issue is found, then set the branch protection rule to require the CI check to pass.
   • DRun a dependency scan in a nightly scheduled workflow and post the results as a comment on the pull request.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A startup with a small DevOps team uses GitLab for source control and wants to add CI without introducing a new tool. They need to run unit tests and a container image build on every merge request. Which approach best meets their requirement?

   • ASet up Jenkins with a multibranch pipeline that polls the GitLab repository every minute.
   • BInstall TeamCity and configure a VCS root pointing to the GitLab repository.
   • CConfigure a GitLab CI pipeline using .gitlab-ci.yml with test and build stages triggered on merge requests.
   • DUse GitHub Actions with a workflow file that triggers on pull_request events.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which of the following is a common security scanning tool that can be integrated into a CI pipeline?

   • AJenkins
   • BGit
   • CDocker
   • DSonarQube
   Reveal Solution Discussion Select an answer first