Continuous Security with Security as Code DSE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A team wants to automate security testing for their infrastructure code. They use Ansible for configuration management and want to ensure that the playbooks do not violate security policies, such as opening unnecessary ports or using weak encryption. What should they add to their CI pipeline?

   • AA manual review of the playbooks by a security engineer before each deployment.
   • BA policy-as-code tool that scans the Ansible playbooks for security violations and fails the build if any are found.
   • CA post-deployment scan of the live infrastructure to detect misconfigurations.
   • DA script that runs the playbooks in a test environment and checks the resulting configuration.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company is building a CI/CD pipeline that deploys infrastructure using Terraform. The pipeline needs to authenticate to the cloud provider using a service principal. The team wants to follow Security as Code principles and avoid storing credentials in the pipeline configuration. Which approach should they use?

   • AStore the service principal password as an encrypted variable in the CI/CD platform's project settings.
   • BUse the CI/CD platform's built-in secret store and hard-code the secret name in the pipeline YAML.
   • CReference the service principal credentials from a centralized secrets vault, and grant the pipeline a short-lived token with least-privilege access.
   • DEmbed the service principal credentials directly in the Terraform configuration files stored in Git.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the purpose of an approval workflow in a pipeline?

   • ATo generate a list of all vulnerabilities in the code
   • BTo speed up the pipeline by skipping security checks
   • CTo require human authorization before a deployment proceeds
   • DTo automatically deploy code without any human intervention
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company wants to improve its security posture by continuously monitoring the effectiveness of its security controls in the CI/CD pipeline. They have multiple teams and want to track metrics such as the number of vulnerabilities found, time to fix, and policy violations over time. What should they implement?

   • AA log file that stores all security scan outputs without any analysis or alerting.
   • BA centralized dashboard that aggregates security scan results and policy violations from all pipelines, with trend analysis and alerting.
   • CA shared spreadsheet where each team manually enters their security metrics.
   • DA weekly email report that lists all security findings from the previous week.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is a primary benefit of treating security policies as code artifacts?

   • ASecurity policies are automatically generated from compliance reports.
   • BSecurity policies become invisible to developers and require no maintenance.
   • CSecurity policies eliminate the need for any manual security review.
   • DSecurity policies can be reviewed, versioned, and tested like application code.
   Reveal Solution Discussion Select an answer first