Continuous Security with Security as Code DSE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the role of a security gate in a CI/CD pipeline?

   • ATo block or flag deployments when security scan results exceed a threshold
   • BTo bypass security checks for urgent releases
   • CTo notify developers after deployment about security issues
   • DTo automatically fix all vulnerabilities found in the code
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security team is automating compliance tests in the pipeline. They have a policy that requires all API responses to include a specific security header. They want to test this as part of the pipeline. Which type of test should they implement?

   • AA dependency scan that checks if the web framework includes the header by default.
   • BA DAST test that sends requests to the deployed application and checks the response headers.
   • CA unit test that checks the header in the application's test suite.
   • DA SAST test that scans the source code for the header configuration.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which principle should guide the use of secrets in CI/CD pipelines?

   • AStore secrets in the pipeline logs for debugging
   • BShare secrets widely to avoid pipeline failures
   • CLeast privilege: grant only the minimum permissions needed for each job
   • DUse the same secret for all environments to simplify management
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company is deploying a critical application. Their pipeline includes security scans, but they want to add a manual approval step for the security team before production deployment. The team also wants to track how long approvals take. Which approach should they use?

   • AUse a chat bot to ask for approval, but do not record the decision.
   • BHave the security team manually trigger the deployment after reviewing the scan report outside the pipeline.
   • CAutomatically approve the deployment if all scans pass, without any manual step.
   • DAdd a manual approval gate in the pipeline that requires a security team member to approve, and log the approval time.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company is implementing Policy as Code for their CI/CD pipeline. They have a policy that requires all secrets to be stored in a vault and not in the repository. They want to enforce this policy across all repositories. Which approach should they take?

   • ARely on developers to manually ensure that secrets are not committed.
   • BUse a combination of pre-commit hooks, pipeline secret scanning, and periodic repository scans to enforce the policy.
   • CUse a pre-commit hook that scans for secrets and blocks the commit if any are found.
   • DUse a secret scanning tool that runs in the CI/CD pipeline and fails the build if secrets are detected.
   Reveal Solution Discussion Select an answer first