Key Elements of the DevSecOps Pipeline DSE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is a key practice for integrating logging into a pipeline for security visibility?

   • ACentralizing logs from all pipeline stages in a secure, searchable repository
   • BStoring logs only on the local machine where the pipeline runs
   • CDisabling logging to improve performance
   • DKeeping logs in plaintext without access controls
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A DevSecOps team is troubleshooting why developers are not fixing security findings from the pipeline. The findings are posted to a security dashboard, but developers say they do not have time to check it. The team wants to improve the remediation rate without adding more manual steps. What should they do?

   • ACreate a weekly meeting to review all open findings with the development team.
   • BIncrease the severity threshold so that only critical findings are shown on the dashboard.
   • CSend a daily email summary of all open findings to the development team.
   • DIntegrate the pipeline to post findings as comments on the relevant pull request and set the build to fail on critical findings.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which of the following is an example of automating a compliance check in a pipeline?

   • AA security review meeting held before each deployment
   • BA script that verifies infrastructure configuration against policy as code
   • CA quarterly penetration test performed by an external firm
   • DA manual checklist that a security engineer completes after each release
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is a key measure to secure third-party dependencies used in a build?

   • ADownloading dependencies from any available source
   • BAvoiding the use of any third-party libraries
   • CUsing a software composition analysis (SCA) tool to scan for known vulnerabilities
   • DPinning dependencies to a specific version without checking for updates
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A security team wants to detect a supply-chain attack where a malicious dependency is introduced into a build. They have implemented SCA scanning, but they are concerned that the SCA tool may not catch a newly published malicious package that is not yet in vulnerability databases. What additional measure should they add to the pipeline?

   • ARun a runtime security scanner in production that detects malicious behavior from dependencies.
   • BUse a network-level firewall to block access to public package repositories from the build environment.
   • CIncrease the frequency of SCA scans and rely on the tool's real-time database updates.
   • DImplement a dependency allowlist that only permits known-good versions, and require a human review for any new dependency.
   Reveal Solution Discussion Select an answer first