Key Elements of the DevSecOps Pipeline DSE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A team is building a pipeline for a containerized application. They want to ensure that the container image is secure and that the same image is deployed to all environments. They also want to avoid rebuilding the image for each environment. Which pipeline design best meets these requirements?

   • ABuild the image once, scan it for vulnerabilities, sign it, and then promote the same signed image through staging to production.
   • BBuild a separate image for each environment to ensure environment-specific configurations are included.
   • CBuild the image in production and scan it after deployment.
   • DUse a base image from a public repository and do not scan it, relying on the repository's security.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A team uses Terraform to manage their cloud infrastructure. They want to ensure that any change to the infrastructure is reviewed and that the resulting environment is monitored for security issues. Which practice should they adopt?

   • ARun Terraform apply in the pipeline without any approval gates and then run a compliance scan after deployment.
   • BUse a separate Terraform workspace for each environment and manually review the plan output before applying.
   • CAllow any developer to apply Terraform changes directly to production and rely on the cloud provider's audit logs.
   • DStore Terraform configurations in Git, require pull requests for changes, and integrate a policy-as-code tool that runs in the CI pipeline to validate compliance.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Why is it important to treat deployment environments as code?

   • AIt eliminates the need for security monitoring
   • BIt allows developers to bypass security controls
   • CIt allows environments to be consistently provisioned and audited
   • DIt makes environments immutable and unchangeable
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A development team is building a Node.js application and uses many open-source packages. They want to ensure that no vulnerable or malicious dependencies are deployed to production. The team has a CI pipeline that builds the application and runs unit tests. Which additional step should they add to the pipeline to address this concern?

   • AEnable automatic dependency updates in the repository and rely on the CI pipeline to run tests after each update.
   • BRun a software composition analysis (SCA) tool that checks the dependency lock file against known vulnerability databases and fails the build on critical findings.
   • CManually review the package.json file before each release to ensure no suspicious packages are included.
   • DUse a container image scanner on the final Docker image to check for vulnerabilities in the base image and installed packages.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A company is building a CI/CD pipeline for a Python application. They use many open-source packages and are concerned about supply chain attacks. They want to ensure that only approved dependencies are used and that the build is reproducible. Which approach best addresses these concerns?

   • AUse a lock file but do not enforce an allowlist, and allow any package to be installed.
   • BUse a public package repository and rely on the community to report vulnerabilities.
   • CUse a private package repository that proxies PyPI, enforces an allowlist of approved packages, and pins all dependencies to exact versions in a lock file.
   • DDownload packages directly from PyPI and use a requirements.txt file with version ranges.
   Reveal Solution Discussion Select an answer first