Integrating Security into the DevOps Pipeline DSE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary benefit of integrating security testing early in the software development lifecycle (shift-left)?

   • AIt allows security testing to be performed manually by developers
   • BIt guarantees that no vulnerabilities will be present in production
   • CIt reduces the cost and effort required to fix security vulnerabilities
   • DIt eliminates the need for security testing after deployment
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   In a CI/CD pipeline, which type of automated security test is most appropriate for identifying vulnerabilities in the application's source code without executing it?

   • ASAST (Static Application Security Testing)
   • BRASP (Runtime Application Self-Protection)
   • CDAST (Dynamic Application Security Testing)
   • DIAST (Interactive Application Security Testing)
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which automated security test is best suited for detecting vulnerabilities in a running web application, such as SQL injection or cross-site scripting?

   • AContainer image scanning
   • BSAST (Static Application Security Testing)
   • CDependency scanning
   • DDAST (Dynamic Application Security Testing)
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A development team uses a CI/CD pipeline that builds a container image, runs unit tests, and then pushes the image to a registry. The security team wants to prevent any image with a critical vulnerability from being deployed to production. Which approach should be implemented?

   • ARequire a manual approval step before the image is pushed to the registry.
   • BConfigure the container registry to automatically delete any image that has a critical vulnerability.
   • CRun a SAST scan on the source code before the build and only fail the pipeline if a critical issue is found.
   • DAdd a pipeline stage after the build that runs a container image scanner and fails the pipeline if a critical vulnerability is found.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company uses a central artifact repository. They want to ensure that only artifacts that have passed security scans are deployed. However, some artifacts are built by external teams and uploaded directly to the repository. What is the best way to enforce this policy?

   • ATrust all artifacts from external teams because they are in the repository.
   • BRequire that all artifacts be signed by a trusted key and include scan metadata that is verified before deployment.
   • CUse a separate repository for external artifacts.
   • DRun a security scan on the repository periodically.
   Reveal Solution Discussion Select an answer first