Key Elements of the DevSecOps Pipeline DSE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company is designing a CI/CD pipeline for a web application. They want to integrate security checks at the appropriate stages. Which of the following is the most effective way to integrate security into the pipeline stages?

   • ARun SAST during the build stage, dependency scanning during the build stage, and DAST against a staging environment during the deploy stage.
   • BRun SAST and dependency scanning only in the production environment after deployment.
   • CRun DAST during the build stage before the application is deployed.
   • DRun all security checks only at the end of the pipeline before release.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which mechanism is commonly used to communicate security feedback to developers within a pipeline?

   • APosting findings on a public website
   • BStoring results in a database without notification
   • CFailing the build with a detailed error message
   • DSending a monthly security newsletter
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   In a typical CI/CD pipeline, which stage is primarily responsible for compiling source code and running unit tests?

   • APlan stage
   • BBuild stage
   • CDeploy stage
   • DMonitor stage
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security team wants to correlate security events from the CI/CD pipeline with events from the production environment to detect attacks that may have originated from a compromised build. What should they implement?

   • ACentralized logging that collects pipeline logs and production logs into a single SIEM platform with correlation rules.
   • BA dashboard that shows pipeline logs and production logs side by side, but without any correlation rules.
   • CStore pipeline logs in a secure bucket and production logs in a different secure bucket, with access limited to the security team.
   • DSeparate logging systems for the pipeline and production, with manual comparison when an incident occurs.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security team wants to detect anomalous behavior in a production environment immediately after a new deployment. They have access to the CI/CD pipeline and the cloud platform. What should they implement?

   • ASchedule a daily batch job to review logs and send a report to the security team.
   • BEnable verbose logging in production but do not set up any alerts.
   • CIntegrate the deployment stage with a monitoring and alerting system that tracks key metrics and logs, and triggers alerts based on predefined thresholds.
   • DRely on developers to manually check the application's health after each deployment.
   Reveal Solution Discussion Select an answer first