Key Elements of the DevSecOps Pipeline DSE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the main purpose of a feedback loop in a DevSecOps pipeline?

   • ATo delay the release of software until all security issues are resolved
   • BTo replace the need for automated security testing
   • CTo generate compliance reports for external auditors
   • DTo provide developers with rapid information about security issues so they can fix them quickly
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company has a CI/CD pipeline that deploys a web application. The security team wants to implement continuous monitoring and logging, but they are concerned about the performance impact on the application. They also want to ensure that security events are correlated across the pipeline and the application. Which approach best addresses these concerns?

   • AUse a centralized logging and monitoring solution that collects logs from the application and the pipeline, and use a correlation engine to detect security incidents.
   • BUse a lightweight agent on the application that sends logs to a third-party service, but do not integrate with the pipeline.
   • CDisable logging in production to avoid performance impact and rely on the pipeline logs only.
   • DEnable logging on the application only and store logs locally on the application server.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company has a CI/CD pipeline that includes SAST and dependency scanning. The security team wants to ensure that developers fix security findings quickly, but they are concerned that too many false positives will cause developers to ignore the results. Which approach best addresses this concern?

   • AConfigure the security tools to suppress known false positives and provide a clear severity rating, and integrate the findings into the developer's IDE and pull request comments.
   • BOnly show findings that are critical or high severity, and ignore medium and low findings.
   • CSend all findings to the security team and have them manually triage and assign each one to a developer.
   • DFail the build on any finding, regardless of severity, to force developers to fix everything.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company is building a Java application and uses Maven to manage dependencies. They want to ensure that the build artifacts are secure and that dependencies are not tampered with. Which measure should they implement in the pipeline?

   • ADownload dependencies directly from the public Maven Central repository without any additional checks.
   • BRely on the Maven build to fail if a dependency is not available.
   • CUse a checksum verification step that only checks the integrity of the final JAR file.
   • DUse a private artifact repository that proxies external repositories and scans all dependencies for known vulnerabilities before they are cached.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   How does continuous monitoring contribute to security in a DevSecOps pipeline?

   • ABy replacing the need for automated testing
   • BBy eliminating the need for logging
   • CBy preventing all security incidents
   • DBy providing ongoing visibility into application and infrastructure security
   Reveal Solution Discussion Select an answer first