Continuous Security with Security as Code DSE Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   A DevSecOps team has implemented security gates in their pipeline. They notice that developers are often blocked by false positives from the SAST tool. The team wants to reduce the number of false positives while maintaining security. Which approach should they take?

   • ADisable the SAST gate entirely to avoid blocking developers.
   • BAutomatically approve any SAST finding that is older than 30 days.
   • CIncrease the severity threshold to only block on critical findings, ignoring all others.
   • DTune the SAST tool's rules and suppress known false positives, but require a human review for any suppressed finding.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   What is a key security best practice for Infrastructure as Code (IaC) templates?

   • AUsing the latest version of every resource without pinning versions
   • BStoring IaC templates in version control and reviewing changes before deployment
   • CDeploying directly to production without testing
   • DHardcoding credentials in the templates for convenience
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A company uses Terraform to provision cloud infrastructure. They want to ensure that all Terraform modules enforce a minimum set of security tags and prohibit the use of overly permissive security group rules. The checks must run automatically before any infrastructure is deployed. What is the most effective way to achieve this?

   • AAdd a manual review step in the pipeline where a senior engineer inspects every Terraform plan.
   • BRun a script after deployment that checks the live infrastructure for compliance and alerts if violations are found.
   • CUse a Terraform provider that automatically adds the required tags and fixes security group rules.
   • DIntegrate a policy-as-code tool like OPA or Sentinel into the CI pipeline to evaluate Terraform plans against the security policies.
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A security team wants to establish continuous security monitoring for their CI/CD pipeline. They have multiple pipelines and want to track the number of vulnerabilities found by SAST and DAST scans, the time to remediate, and the number of policy violations. They also want to set up alerts when the number of critical vulnerabilities exceeds a threshold. What should they implement?

   • AA centralized monitoring system that collects scan results from all pipelines, calculates metrics, and triggers alerts based on thresholds.
   • BA script that runs after each pipeline and sends an email with the scan results to the security team.
   • CA manual process where each team reports their security metrics monthly.
   • DA dashboard that shows the results of the last scan for each pipeline, but does not aggregate or alert.
   Reveal Solution Discussion Select an answer first
6. 50foundation · easy

   Which approach best describes Policy as Code implementation?

   • AConfiguring security policies through a cloud provider's web interface.
   • BDocumenting security policies in a PDF and emailing them to developers.
   • CUsing a spreadsheet to track compliance status manually.
   • DWriting security policies in a declarative language and enforcing them programmatically in the pipeline.
   Reveal Solution Discussion Select an answer first