Integrating a Continuous Feedback Loop DSE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A DevSecOps team is designing a CI/CD pipeline for a critical application. They want to include security feedback gates, but they have two conflicting requirements: the pipeline must not slow down the development cycle, and it must catch high-severity vulnerabilities before production. They have a limited budget for compute resources. Which approach best meets both requirements?

   • ARun fast SAST and dependency scans on every commit, and run full DAST and container scans only on merge requests to the main branch.
   • BDisable all security scans during the development phase and run them only before a production release.
   • CRun all security scans on every commit and block the build on any finding.
   • DRun all security scans only on the main branch after merge.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Why is it important to prioritize feedback items in a DevSecOps environment?

   • ATo make the feedback loop more complex
   • BTo ensure that all issues are fixed in the order they are reported
   • CTo focus resources on the most critical issues first
   • DTo avoid fixing any issues until the end of the project
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A DevSecOps team wants to automatically fail a build in the CI/CD pipeline when a high-severity vulnerability is found in a container image. The pipeline already runs a container security scanner that outputs a JSON report. What should the team implement to achieve this without manual intervention?

   • AA post-build script that parses the JSON report, checks for high-severity findings, and exits with a non-zero code if any are present
   • BA manual review step in the pipeline where a security engineer approves each image before deployment
   • CA configuration change to the container registry to block all image pulls
   • DA scheduled job that runs the scanner nightly and emails the security team a summary of findings
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A DevSecOps team collects feedback from multiple sources: SAST, DAST, dependency scans, and production monitoring. They notice that the number of open vulnerabilities is increasing, but the number of critical vulnerabilities is decreasing. The team has limited remediation resources. How should they prioritize their efforts?

   • AStop tracking vulnerabilities because the data is conflicting
   • BFocus on the decreasing critical vulnerabilities to maintain the trend, while tracking the increase in lower-severity issues for future planning
   • CIgnore the trend and remediate vulnerabilities in the order they were reported
   • DFocus on the increasing number of lower-severity vulnerabilities to reduce the total count
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security scan in the CI/CD pipeline has been failing the build for the same critical vulnerability for two weeks. Developers keep fixing it locally, but it reappears because the vulnerable library is pulled from a shared repository. What is the most effective way to close the loop on this recurring feedback?

   • AUpdate the shared repository to a patched version of the library and add a policy that blocks the vulnerable version in the pipeline
   • BRemove the failing pipeline step to allow builds to pass
   • CAsk developers to manually update the library in each project
   • DIncrease the severity threshold to critical so the build passes
   Reveal Solution Discussion Select an answer first