Key Elements of the DevSecOps Pipeline DSE Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A team uses infrastructure as code (IaC) to provision cloud environments. They want to prevent misconfigured resources from being deployed to production. Which pipeline integration is most effective?

   • APerform a manual review of the IaC templates by the security team after deployment.
   • BRun an IaC security scanner in the CI pipeline before the deployment stage and fail the pipeline on critical misconfigurations.
   • CUse a cloud provider's default security settings and assume they are secure.
   • DDeploy to production first and then run a compliance scan to identify issues.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A company is designing a CI/CD pipeline for a legacy application that is difficult to test automatically. The security team wants to integrate security checks, but the development team is concerned about the pipeline becoming too slow. Which approach best addresses the needs of both teams?

   • ARun security checks only on the main branch after merging.
   • BRun lightweight security checks (e.g., dependency scanning and SAST) on every commit, and run heavier checks (e.g., DAST and penetration testing) on a nightly schedule or before release.
   • CRun all security checks on every commit to ensure maximum coverage.
   • DRun all security checks only before release to minimize the impact on the pipeline.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A team is designing a new CI/CD pipeline for a web application. They want to include security checks as early as possible to reduce the cost of fixing issues. Which stage should they add first?

   • AA static application security testing (SAST) stage that runs immediately after the code commit and before the build.
   • BA container image scanning stage that runs after the image is built.
   • CA dynamic application security testing (DAST) stage that runs against the deployed staging environment.
   • DA software composition analysis (SCA) stage that runs after the build and before packaging.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which practice helps secure build artifacts in a CI/CD pipeline?

   • ASigning artifacts with a digital signature
   • BStoring artifacts in a public repository
   • CUsing plaintext credentials in artifact metadata
   • DDisabling checksums for faster downloads
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A development team is using a CI pipeline that includes SAST and dependency scanning. The security team notices that developers often ignore security findings because they are buried in long reports. The team wants to improve the feedback loop so that developers address security issues quickly. Which action would be most effective?

   • ARequire developers to manually check the security dashboard once a week.
   • BCreate a separate security report that is only available to the security team.
   • CIntegrate the security scanning tools with the team's chat platform and send a summary of findings with links to the relevant code lines.
   • DSend the full security report to the entire team via email after each build.
   Reveal Solution Discussion Select an answer first