Continuous Security with Security as Code DSE Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A company is deploying a microservices application. Each service has its own pipeline with security scans. The security team wants to enforce a policy that no service can be deployed to production if any critical vulnerability is found in any service. However, they also want to avoid blocking all services if one service has a critical issue. Which approach should they take?

   • AImplement a centralized policy that aggregates scan results from all services and blocks the deployment of the entire application if any critical finding exists.
   • BDeploy all services and then roll back the entire application if a critical issue is found in any service.
   • CBlock the deployment of the specific service with the critical finding, but allow other services to deploy.
   • DAllow each service to deploy independently, but flag the critical finding in a dashboard for review.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which type of security scanning tool is used to analyze source code for vulnerabilities without executing the application?

   • AContainer scanning
   • BSAST (Static Application Security Testing)
   • CDAST (Dynamic Application Security Testing)
   • DDependency scanning
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A security team is implementing Policy as Code for their CI/CD pipeline. They have a policy that requires all production deployments to have a specific security label. However, they are concerned that the policy might be too strict and block legitimate deployments. They want to test the policy before enforcing it. Which approach should they take?

   • ACreate a separate policy that is less strict and use that in production.
   • BRun the policy in a dry-run mode that reports violations without blocking, and review the results in a staging environment.
   • CEnforce the policy immediately and monitor for any blocked deployments.
   • DManually review each deployment against the policy before applying it.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which characteristic is a core principle of Security as Code?

   • ASecurity controls are configured through a cloud provider's web console only.
   • BSecurity policies are enforced by a separate security team outside the pipeline.
   • CSecurity policies are documented in a central wiki and manually reviewed each release.
   • DSecurity policies are stored as versioned, testable, and automated code artifacts.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A CI/CD pipeline needs to access a database to run integration tests. The database credentials are stored in a secrets vault. The team wants to ensure that the pipeline can retrieve the credentials without exposing them in logs. Which configuration should they use?

   • AUse a pipeline step that fetches the credentials from the vault and injects them as environment variables, ensuring the step does not echo the values.
   • BStore the credentials as plaintext in the pipeline configuration file.
   • CHave the pipeline print the credentials to the console for debugging purposes.
   • DUse a hardcoded credential in the test script that is committed to the repository.
   Reveal Solution Discussion Select an answer first