Integrating Security into the DevOps Pipeline DSE Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A company's CI/CD pipeline needs to deploy to a cloud environment. The pipeline must use a service account credential to authenticate. The security team wants to ensure the credential is not stored in the repository or visible in logs. What is the recommended approach?

   • AHardcode the credential in the pipeline definition file.
   • BAsk developers to enter the credential manually each time the pipeline runs.
   • CStore the credential as a secret in the CI/CD platform's secret store and reference it in the pipeline using a variable.
   • DEncrypt the credential and commit it to the repository with a note in the README.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A startup is building a new application and wants to adopt a DevSecOps approach. They have limited security staff and want to minimize the cost of fixing vulnerabilities. Which strategy should they prioritize?

   • AWait until the application is feature-complete before starting any security work.
   • BPerform a penetration test once a year on the production application.
   • CHire a security consultant to review code after each release.
   • DIntegrate automated security testing into the CI pipeline so developers get immediate feedback.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is the purpose of a security gate in a CI/CD pipeline?

   • ATo provide a log of all security events for auditing purposes
   • BTo block the promotion of an artifact to the next stage if security criteria are not met
   • CTo automatically fix any security vulnerabilities found in the code
   • DTo replace the need for manual security reviews
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   How can a pipeline securely inject a secret into an application at runtime without exposing it in logs?

   • ABy printing the secret to the console during the build
   • BBy referencing the secret from a secrets manager and passing it as an environment variable
   • CBy storing the secret in a text file in the repository
   • DBy including the secret in the pipeline's YAML file
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A team wants to embed security controls throughout their CI/CD pipeline. They have already added SAST in the build stage. Which additional control should they add to cover the artifact and deployment stages?

   • ARun DAST only in the build stage.
   • BScan container images for vulnerabilities and sign them before pushing to the registry.
   • CAdd a manual security review after production deployment.
   • DDisable security scanning in the pipeline to avoid slowing down deployments.
   Reveal Solution Discussion Select an answer first