Continuous Security with Security as Code DSE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A DevSecOps team is adopting Policy as Code for their CI/CD pipeline. They want to enforce that all container images deployed to production are scanned for vulnerabilities and that any image with a critical severity finding is blocked. The team maintains the policy in a Git repository and wants the policy itself to be reviewed and versioned. Which approach best meets these requirements?

   • AWrite a declarative policy file in the Git repository that defines the critical-severity gate, and have the pipeline evaluate this policy against scan results before deployment.
   • BAdd a manual approval step in the pipeline where a security engineer reviews the scan report and decides whether to allow the deployment.
   • CConfigure the container registry to automatically block any image with a critical vulnerability, and rely on the registry's built-in audit log for compliance.
   • DUse a pre-built script that parses the scan output and fails the pipeline if any vulnerability is found, regardless of severity.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A team is integrating security scanning into their CI/CD pipeline. They want to scan the application's source code, its dependencies, and the final container image. The team wants to ensure that the scans run as early as possible in the pipeline. Which stage order should they use?

   • ARun dependency scanning first, then build the image, then run SAST on the source code.
   • BRun SAST on the source code first, then dependency scanning, then build the container image and run container scanning.
   • CBuild the container image first, then run SAST on the source code, then run dependency scanning.
   • DRun all scans in parallel at the end of the pipeline, just before deployment.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which type of automated test is used to verify that infrastructure complies with security policies?

   • AUnit tests
   • BIntegration tests
   • CPerformance tests
   • DCompliance tests
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company's CI/CD pipeline uses a service principal to deploy to Azure. The service principal has contributor access to the entire subscription. The security team wants to follow least-privilege principles and reduce the risk of credential compromise. Which change should they make?

   • AUse the existing service principal but store its credentials in a vault.
   • BUse a managed identity for the pipeline instead of a service principal.
   • CKeep the existing service principal but rotate its password every 90 days.
   • DCreate a new service principal with only the permissions needed for the deployment and use it in the pipeline.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company is adopting Infrastructure as Code (IaC) and wants to enforce security policies across multiple teams. They have a mix of Terraform and CloudFormation templates. They want to ensure that all templates comply with the same security policies, but they also want to allow teams to request exceptions for specific resources. The policy engine must be centralized and support both IaC tools. What should they do?

   • AUse a manual review process for all templates, with a security engineer approving each one.
   • BUse a cross-platform policy-as-code tool like OPA that can evaluate both Terraform and CloudFormation templates, with a centralized policy repository and an exception process.
   • CCreate separate policy checks for Terraform and CloudFormation using different tools, and manage them independently.
   • DEnforce policies only at the cloud provider level using service control policies.
   Reveal Solution Discussion Select an answer first