Continuous Security with Security as Code DSE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security team wants to automate compliance checks for their infrastructure as part of the CI/CD pipeline. They have a set of security controls defined in a declarative policy file. They want to run these checks on every code change and fail the build if any control is violated. What is the best way to implement this?

   • ARun the compliance checks manually once a week and document the results in a spreadsheet.
   • BCreate a separate pipeline that runs the checks after deployment and sends an email if violations are found.
   • CAdd the policy file to the repository but do not integrate it into the pipeline.
   • DUse a policy-as-code engine to evaluate the infrastructure code against the policy file in a pipeline stage, failing the build on violations.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company has a Node.js application and wants to integrate security scanning into their CI pipeline. They want to catch vulnerabilities in the source code and in the dependencies. They also want to fail the build if any high-severity issue is found. Which set of scans should they add?

   • AA dependency scan only, with results sent to the team via email.
   • BA DAST scan on the staging environment and a container scan on the built image.
   • CA SAST scan on the source code and a dependency scan on the package-lock.json file, both configured to fail on high-severity findings.
   • DA SAST scan only, with results logged but not failing the build.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A team uses Terraform to manage infrastructure. They want to ensure that all resources have mandatory tags for cost allocation. They have a policy that checks for tags, but the policy is not catching all violations because some resources are created outside of Terraform. Which approach should they take?

   • AUse a combination of Terraform policy checks and a cloud provider's compliance monitoring to detect untagged resources.
   • BManually audit the cloud environment monthly for untagged resources.
   • CRequire all teams to use a specific Terraform module that includes mandatory tags.
   • DOnly rely on the Terraform policy check, since all resources should be managed by Terraform.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A software company wants to integrate security scanning into their CI/CD pipeline. They have a Java application with a large number of open-source dependencies and a separate containerized deployment. They want to catch vulnerabilities as early as possible and block the deployment if critical issues are found. Which combination of scans should they add to the pipeline?

   • ARun a DAST scan on the production environment after deployment and alert the security team on findings.
   • BRun a dependency scan on the source code and a container scan on the built image, both as gates before deployment.
   • CRun a container scan only on the final image and manually review the dependency list.
   • DRun a SAST scan on the source code and a DAST scan on the staging environment, but only report results to the team.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A team uses Terraform to provision cloud resources. They want to prevent configuration drift and ensure that the deployed infrastructure matches the code. Which practice should they implement?

   • AImplement a policy check that validates the Terraform plan against security rules before applying.
   • BRun `terraform plan` in the pipeline and fail the build if the plan shows changes that are not approved.
   • CUse `terraform apply` in the pipeline to automatically reconcile any drift.
   • DStore the Terraform state file in a remote backend and enable versioning.
   Reveal Solution Discussion Select an answer first