Integrating a Continuous Feedback Loop DSE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A team's CI pipeline currently has a security scan that only reports findings but never blocks the build. After a recent production incident caused by a known vulnerability, the team wants to ensure that similar vulnerabilities are caught before deployment. What should they do?

   • AChange the pipeline to fail the build when the scan finds a vulnerability with a severity above a defined threshold.
   • BMove the scan to run only in the production environment.
   • CKeep the scan as a report and ask developers to review it before merging.
   • DIncrease the scan frequency to every hour in the development environment.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the main benefit of integrating feedback mechanisms directly into a CI/CD pipeline?

   • AIt ensures that all code is deployed to production without review
   • BIt eliminates the need for any manual testing
   • CIt allows security and quality checks to occur automatically at each stage
   • DIt makes the pipeline slower to allow for more manual inspection
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A DevSecOps team has been tracking security metrics for six months. They see that the mean time to remediate (MTTR) has decreased, but the number of open vulnerabilities has stayed the same. They also notice that the same types of vulnerabilities keep reappearing. What does this feedback indicate?

   • AThe team is fixing issues faster, but the root causes are not being addressed, so new issues keep appearing.
   • BThe team should stop tracking MTTR because it is not a useful metric.
   • CThe team is not actually fixing any vulnerabilities; the MTTR metric is misleading.
   • DThe security tools are not detecting new vulnerabilities, so the count is stable.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A DevSecOps team collects feedback from multiple sources: CI/CD pipeline failures, SAST scan results, and production monitoring alerts. They notice that the same type of SQL injection vulnerability keeps appearing in different applications. What should the team do to prioritize and address this trend?

   • ADisable the SAST scanner because it is generating too many false positives
   • BIncrease the frequency of SAST scans to catch the vulnerability earlier
   • CAsk each application team to fix their own vulnerabilities independently
   • DAnalyze the feedback data to identify the common root cause, such as a shared code library or lack of input validation, and create a targeted remediation plan
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A team has implemented a continuous feedback loop that automatically blocks builds when critical vulnerabilities are found. After a few weeks, they notice that the number of blocked builds is decreasing. What does this trend most likely indicate?

   • AThe developers are not committing as much code.
   • BThe security scans are no longer detecting vulnerabilities.
   • CThe feedback loop is working because developers are fixing issues before they reach the build stage.
   • DThe team is bypassing the build gate.
   Reveal Solution Discussion Select an answer first