Continuous Security with Security as Code DSE Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A security team wants to adopt Security as Code but faces resistance from developers who say it will slow down their delivery. The team wants to demonstrate the value of Security as Code by showing how it can reduce the number of security issues in production. They also want to ensure that security policies are continuously improved. What is the best way to gain developer buy-in?

   • ACreate a security policy document and ask developers to follow it manually.
   • BAdd a manual security review step to the pipeline, which will slow down delivery but ensure security.
   • CMandate that all developers attend a security training session before they can commit code.
   • DImplement automated security checks in the pipeline and share metrics showing the reduction in production incidents and the time saved by catching issues early.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A development team is migrating their CI/CD pipeline to a new platform. They currently store database credentials in plain text in the pipeline configuration file, which is stored in a Git repository. They need to eliminate this risk while keeping the pipeline functional and ensuring that only the pipeline service account can access the credentials. What should they do?

   • AEncrypt the credentials with a hard-coded key in the pipeline configuration and commit the encrypted value.
   • BMove the credentials to a separate private repository and clone it during the pipeline run.
   • CStore the credentials in a secrets vault and reference them via a pipeline variable that is resolved at runtime using the service account's identity.
   • DAsk developers to enter the credentials manually each time the pipeline runs.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A DevOps team is designing a CI/CD pipeline for a critical application. They want to ensure that no deployment occurs if a SAST scan finds a critical vulnerability, but they also want to allow the security team to approve a deployment in exceptional cases. The approval must be recorded and traceable. What should they configure?

   • AA pipeline that always deploys and then sends an alert to the security team if critical findings are present.
   • BA pipeline that skips the SAST scan for releases and only runs it on pull requests.
   • CA pipeline that fails the build on any SAST finding, regardless of severity, without an override option.
   • DA pipeline gate that fails the build on critical SAST findings, with a manual approval step that can override the failure and logs the approver and reason.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A team is setting up a CI/CD pipeline for a microservices application. They need to pass a database password to a deployment job. The password is stored in a secrets manager. They want to ensure that the password is not exposed in logs or build artifacts. What is the best practice?

   • AHard-code the password in the pipeline configuration file.
   • BStore the password in a file in the repository and read it during the pipeline run.
   • CRetrieve the password from the secrets manager at runtime and inject it as an environment variable, ensuring the pipeline does not log environment variables.
   • DPass the password as a command-line argument to the deployment script.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A platform team manages a shared CI/CD pipeline used by multiple product teams. They need to enforce a company-wide policy that no container image with critical vulnerabilities can be deployed, but they also want to allow teams to override the block for a specific image with a documented exception. The policy must be reviewed and versioned like code. What should they implement?

   • AA post-deployment monitoring alert that notifies the security team when a critical vulnerability is found in production.
   • BA manual approval step in the pipeline where a security engineer reviews every image before deployment.
   • CA pipeline gate that queries the container registry for vulnerability results and fails the build unless an approved exception ID is provided in the commit message.
   • DA script that scans images locally and prints a warning if critical vulnerabilities are found, but does not fail the pipeline.
   Reveal Solution Discussion Select an answer first