Integrating Security into the DevOps Pipeline DSE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which practice is an example of integrating compliance checks into a CI/CD pipeline?

   • ARunning a policy-as-code tool to validate infrastructure before deployment
   • BPerforming a quarterly security audit of the production environment
   • CConducting a manual compliance review after every release
   • DSending compliance reports via email to stakeholders
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A startup wants to reduce the cost and effort of fixing security vulnerabilities. Currently, they only run security scans after the application is deployed to staging. What change would best align with shift-left security?

   • ARun SAST and dependency scans in the CI stage before the build.
   • BAdd more security personnel to review staging scan results.
   • CDeploy to production faster to get real-world feedback.
   • DIncrease the frequency of staging environment scans.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A pipeline promotes a build artifact from a test environment to production. The security team wants to ensure that only artifacts that have passed all security checks are promoted. What is the best way to enforce this?

   • AAllow promotion and then run a security scan in production.
   • BAdd a security gate that checks the artifact's scan results and fails the promotion if any critical issue is unresolved.
   • CManually verify the artifact's security status before each promotion.
   • DRely on the artifact's version number to indicate security status.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A team is adopting Infrastructure as Code (IaC) to deploy cloud resources. They want to prevent misconfigurations such as open security groups or unencrypted storage from reaching production. Which practice should they integrate into their pipeline?

   • ADeploy IaC templates to production and then run a compliance scan.
   • BReview IaC templates manually after deployment to identify misconfigurations.
   • CUse a configuration management tool to apply templates without any security checks.
   • DRun static analysis on IaC templates in the build stage and fail the pipeline on policy violations.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which practice best exemplifies a shift-left approach to security?

   • APerforming a penetration test on the production environment after each release
   • BHiring a third-party auditor to assess the final product before release
   • CRunning a vulnerability scan on the deployed application weekly
   • DConducting a security review of the application architecture before coding begins
   Reveal Solution Discussion Select an answer first