DevOps Principles and Pipelines DSE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An organization is adopting DevSecOps. The security team currently reviews code only at the end of the development cycle, causing delays. They want to shift security left and share responsibility across teams. Which approach best aligns with DevSecOps principles?

   • ACreate a separate security pipeline that runs independently of the development pipeline.
   • BEmbed security engineers in development teams and provide automated security checks in the CI/CD pipeline.
   • CKeep security reviews at the end of each sprint as a separate gate.
   • DHave developers perform security reviews only after the code is deployed to production.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company has a mature CI/CD pipeline that automatically deploys to staging. The business wants to increase release frequency but is worried about security. They have automated SAST and dependency scanning in the pipeline. Which approach would best allow them to move toward continuous deployment while managing security risk?

   • AKeep the manual approval for production but require the security team to respond within one hour.
   • BAdd a security gate that blocks production deployment if critical vulnerabilities are found, and start with continuous deployment to a small percentage of users using feature flags.
   • CRemove the security scans from the pipeline to speed up the process.
   • DDeploy every change to production automatically without any security checks.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company is building a CI/CD pipeline for a Java application that uses many open-source libraries. They want to prevent known vulnerable libraries from reaching production. Which security check should they integrate into the pipeline?

   • ADAST, which tests the running application for vulnerabilities.
   • BDependency scanning, which checks the versions of open-source libraries against known vulnerability databases.
   • CContainer scanning, which checks the base image for vulnerabilities.
   • DSAST, which analyzes the application's source code for security flaws.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company wants to minimize the time between a code commit and its availability to users. They have a highly automated test suite and are comfortable with fully automated releases. Which practice should they adopt?

   • AScheduled releases, where changes are accumulated and deployed once a month.
   • BContinuous deployment, where every change that passes automated tests is automatically deployed to production.
   • CContinuous delivery, where every change is deployed to staging and a manual approval is required for production.
   • DContinuous integration, where every change is merged and tested but not deployed.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A large enterprise has separate development, operations, and security teams. The security team currently performs a manual review at the end of each release, which causes delays. The company wants to adopt DevSecOps but the security team is concerned about losing oversight. Which approach best balances the need for speed with the security team's need for oversight?

   • AHave the security team create a checklist that developers must follow before each release.
   • BKeep the manual security review but move it earlier in the pipeline, before the test stage.
   • CEmbed security engineers into the development teams and have them define automated security checks that run in the CI/CD pipeline, with the security team reviewing the results and policies.
   • DAllow developers to self-certify that their code is secure and deploy without security review.
   Reveal Solution Discussion Select an answer first