Integrating Security into the DevOps Pipeline DSE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A development team is introducing security testing into their CI/CD pipeline. They want to catch vulnerabilities as early as possible to reduce remediation cost. Which approach best achieves this goal?

   • ARun SAST once a week on the main branch and review results manually.
   • BRun dependency scanning only in the release branch before production deployment.
   • CRun SAST on every commit in the build stage and fail the build on critical findings.
   • DRun DAST against the staging environment after deployment and report findings to the team.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A financial services company must ensure that every deployment to production complies with internal policies, such as specific encryption standards and logging requirements. They want to automate this verification. What should be integrated into the pipeline?

   • AAdd a compliance check stage that runs policy-as-code tests against the deployment configuration.
   • BRequire a security team member to approve every production deployment.
   • CPerform a manual compliance review after each production deployment.
   • DUse a runtime monitoring tool that alerts on non-compliant resources.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company distributes software artifacts through an internal repository. They are concerned about an attacker tampering with artifacts before they are downloaded by other teams. What should they implement to ensure artifact integrity?

   • AUse a checksum file stored alongside the artifact.
   • BRely on the repository's built-in versioning to prevent tampering.
   • CSign artifacts with a private key and verify the signature in the pipeline before use.
   • DStore artifacts in a repository with access controls but no signing.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company has a policy that all artifacts must pass security scanning and compliance checks before being promoted to production. However, a critical hotfix needs to be deployed immediately to address a production incident. The hotfix has a known vulnerability that fails the security gate. What is the best course of action?

   • ABlock the deployment until the vulnerability is fixed, regardless of the incident.
   • BTemporarily bypass the security gate for this hotfix and document the exception with a risk acceptance.
   • CIgnore the security gate and deploy directly to production.
   • DDeploy the hotfix without any documentation to save time.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An organization must comply with a regulation that requires all production deployments to be accompanied by evidence of security testing. They want to automate the collection of this evidence. What should they implement?

   • AA pipeline stage that runs security scans and stores the results as artifacts with timestamps.
   • BA verbal confirmation from the security team that testing was done.
   • CA manual process where developers save screenshots of scan results.
   • DA post-deployment report generated from production logs.
   Reveal Solution Discussion Select an answer first