Key Elements of the DevSecOps Pipeline DSE Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A team is building a CI/CD pipeline for a large monorepo with many microservices. They want to automate security checks, but they are concerned about the pipeline taking too long. They also need to ensure that security checks are not skipped for any service. Which approach best addresses these concerns?

   • ARun the full security scan on every commit for all services.
   • BUse a pipeline that dynamically builds only the services affected by a change and runs security checks on those services, while also running a nightly full pipeline that scans all services.
   • CRun security checks only on the main branch after merging.
   • DRun security checks only on services that have been modified in the last 30 days.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   What does the term 'pipeline as code' refer to in a DevSecOps context?

   • AUsing a visual editor to design the pipeline without any files
   • BWriting the application code in a scripting language
   • CStoring pipeline logs in a code repository
   • DDefining the CI/CD pipeline configuration in a version-controlled file
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A company is building a CI/CD pipeline for a containerized microservices application. They want to ensure that security checks are integrated at the right points. Which of the following is the most effective way to integrate security into the pipeline?

   • APerform a container image scan for known vulnerabilities immediately after the image is built and before it is pushed to the registry.
   • BRely on the base image provider's security updates and do not scan the image.
   • CScan the container image only when a new base image is released.
   • DScan the container image only after it is deployed to the production environment.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A team is building a mobile app and wants to automate security checks in their CI pipeline. They currently have a pipeline that builds the app and runs unit tests. They want to add security testing without significantly slowing down the pipeline. Which approach best balances speed and coverage?

   • ARun only DAST scans on the final build before release.
   • BRun SAST scans only on the main branch after merging.
   • CRun both SAST and DAST scans on every commit to ensure maximum coverage.
   • DRun a fast SAST scan on every commit and a more comprehensive DAST scan on the deployed app in a staging environment on a nightly schedule.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A company has a compliance requirement that all changes to the CI/CD pipeline configuration must be approved by the security team. They also want to maintain a full audit trail of who changed what and when. They currently store the pipeline configuration in a shared folder. What is the best way to meet these requirements?

   • AKeep the shared folder but add a manual approval step in the pipeline that requires the security team to sign off on every change.
   • BStore the pipeline configuration in a database with a custom change-tracking table and require security team approval via email.
   • CUse a CI server's built-in audit log to track changes and require the security team to review the log weekly.
   • DMigrate the pipeline configuration to a Git repository, require pull requests with security team approval, and use commit history for the audit trail.
   Reveal Solution Discussion Select an answer first