Key Elements of the DevSecOps Pipeline DSE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which security consideration is important when using infrastructure as code (IaC) in a pipeline?

   • AUsing hard-coded credentials in IaC templates for convenience
   • BScanning IaC templates for misconfigurations before deployment
   • CDeploying IaC directly to production without review
   • DStoring IaC templates in a shared network drive without version control
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company has a CI/CD pipeline that deploys a web application to a Kubernetes cluster. The security team wants to detect and respond to security incidents quickly. They plan to integrate continuous monitoring and logging into the pipeline. Which approach provides the most effective security visibility?

   • AUse a vulnerability scanner that runs once a week against the production environment.
   • BEnable audit logging on the CI/CD platform only, and review the logs after each deployment.
   • CStore logs locally on each pod and have developers manually review them during incident response.
   • DEnable centralized logging for all application and infrastructure components and configure alerts for suspicious activities, such as failed login attempts or unexpected process execution.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A DevSecOps team wants to enforce that every change to the CI/CD pipeline configuration itself undergoes the same security review as application code. They also need to trace which version of the pipeline ran for a specific build. Which approach best meets these requirements?

   • AStore pipeline definitions in a Git repository and use pull requests for changes, with tags or commit hashes recorded in build metadata.
   • BMaintain the pipeline configuration in a shared network folder with restricted write permissions and manual change logs.
   • CExport the pipeline configuration to a PDF after each change and store it in a document management system.
   • DUse a CI server's built-in web editor to modify the pipeline and rely on the server's audit log for change history.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company uses a private package repository to store internal libraries. They want to ensure that only approved versions of these libraries are used in builds. What should they add to the pipeline?

   • AA step that scans the final artifact for known vulnerabilities after the build.
   • BA dependency resolution step that checks the package version against an allowlist of approved versions before the build.
   • CA step that relies on the package repository's access controls to prevent developers from using unapproved versions.
   • DA step that automatically updates all dependencies to the latest version before each build.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which benefit does pipeline as code provide for security auditing?

   • AIt automatically fixes all security vulnerabilities in the pipeline
   • BIt hides security configurations from developers
   • CIt allows security configurations to be versioned and reviewed like application code
   • DIt eliminates the need for security testing
   Reveal Solution Discussion Select an answer first