Integrating Security into the DevOps Pipeline DSE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A regulated organization must ensure that every deployment to production complies with internal security policies. They want to automate this verification as part of the pipeline. What is the most effective way to achieve continuous compliance monitoring?

   • AUse a monitoring tool that alerts on compliance violations after deployment.
   • BConduct a quarterly manual audit of production environments.
   • CRequire a security manager to approve each deployment manually.
   • DIntegrate a compliance check as a pipeline stage that runs policy-as-code tests before deployment.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An organization uses Infrastructure as Code (IaC) to manage cloud resources. They want to ensure that no IaC template can create a publicly accessible storage bucket. What should be implemented?

   • AMonitor the cloud environment after deployment and close any public buckets.
   • BManually review every IaC template before deployment.
   • CAdd a policy-as-code check in the pipeline that fails if the template defines a public bucket.
   • DUse a cloud provider's default settings to block public buckets.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A pipeline job needs to authenticate to a production database during deployment. The team wants to avoid storing credentials in source code or pipeline configuration. What is the most secure way to provide the credentials to the job?

   • AStore the credentials in a secrets management service and inject them as environment variables at runtime.
   • BPut the credentials in a file in the repository and read it during the job.
   • CUse a shared service account with the credentials hard-coded in the deployment script.
   • DEmbed the credentials in the pipeline configuration file as plain text.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the primary purpose of signing artifacts in a secure artifact repository?

   • ATo encrypt the artifact so that only authorized users can read it
   • BTo automatically update the artifact when a new version is released
   • CTo verify the integrity and authenticity of the artifact
   • DTo compress the artifact to reduce storage space
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   In a typical CI/CD pipeline, which stage is the most appropriate to embed a security control that checks for hardcoded credentials in the source code?

   • AMonitoring stage
   • BBuild stage
   • CCommit/trigger stage
   • DDeployment stage
   Reveal Solution Discussion Select an answer first