Continuous Security with Security as Code DSE Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   What is a key component of a feedback loop in continuous security monitoring?

   • ADisabling alerts to reduce noise
   • BSending reports to a regulatory body only
   • CStoring monitoring logs without review
   • DUsing monitoring data to improve security policies and practices
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A security team wants to automate compliance checks as part of the CI/CD pipeline. They have a set of security controls defined in a policy file. The team wants to ensure that the policy file itself is tested before it is used to enforce controls. Which practice should they adopt?

   • AWrite unit tests for the policy file and run them in a separate pipeline stage before the policy is applied.
   • BManually review the policy file during code review and then deploy it directly to production.
   • CUse the policy file in the pipeline without any testing, and rely on the enforcement engine to catch errors.
   • DStore the policy file in a separate repository and only allow security team members to merge changes.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A large enterprise has a CI/CD pipeline that deploys a critical application. They have a security gate that fails the build if a SAST scan finds any critical vulnerability. However, a recent release was blocked because the SAST tool reported a false positive. The team wants to reduce the impact of false positives while maintaining a strong security posture. They also need to ensure that any override is documented and approved by the security team. What is the best approach?

   • ALower the severity threshold to only fail on high-severity findings, so critical false positives do not block the build.
   • BRemove the SAST gate entirely and rely on manual code reviews to catch vulnerabilities.
   • CImplement a triage process where the security team can mark a finding as a false positive, and the pipeline allows the build to proceed only if the finding is marked as such in the scan results.
   • DConfigure the pipeline to automatically deploy when a critical finding is reported, and send an alert to the security team.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A DevSecOps team wants to continuously improve their security posture. They have implemented security scanning in the pipeline and want to track metrics such as vulnerability density and time-to-remediate. Which approach should they take?

   • ACollect scan results and pipeline gate outcomes in a centralized dashboard and review trends monthly.
   • BDisable the pipeline gates after a few successful deployments to reduce friction.
   • CStore scan results in the pipeline logs and only review them when a security incident occurs.
   • DSend scan results to a chat channel and rely on developers to notice and act on them.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   An organization uses Terraform to manage its cloud infrastructure. They want to ensure that all Terraform modules enforce encryption for storage accounts and that any deviation is caught before deployment. The team wants to follow Security as Code principles. Which combination of practices should they implement?

   • AAdd a policy check in the pipeline that validates Terraform plans against a set of rules, and store those rules as code in Git.
   • BCreate a Terraform module that includes encryption by default, and document that all teams must use this module.
   • CUse a post-deployment script that scans the live environment and reports any storage accounts without encryption.
   • DRely on the cloud provider's default encryption settings and periodically review the deployed resources manually.
   Reveal Solution Discussion Select an answer first