Role of DevSecOps in the CI/CD Pipeline DSE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company's CI/CD pipeline needs to deploy to a production cloud environment. The deployment job requires a service principal credential. The team wants to avoid storing the credential in the pipeline definition file. Which approach should they use?

   • AEmbed the credential directly in the pipeline YAML file so it is versioned with the code.
   • BCreate a new service principal for each deployment and store its password in a shared spreadsheet.
   • CStore the credential as a secret in the CI/CD platform's secret store and reference it by name in the pipeline.
   • DHave each developer enter the credential manually when the pipeline runs.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A team is designing a CI/CD pipeline for a microservices application. They want to ensure that security checks are performed at the right stages. Which sequence of security controls is most appropriate?

   • ASAST in the test stage, DAST in the build stage, and dependency scanning after deployment.
   • BSAST in the build stage, dependency scanning in the build stage, DAST in the test stage, and container scanning before deployment.
   • CDAST in the build stage, SAST in the test stage, and container scanning after deployment.
   • DOnly container scanning in the build stage and no other security checks.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which practice is essential for securing secrets (e.g., API keys, passwords) used in a CI/CD pipeline?

   • AStoring secrets in a dedicated secret management tool and referencing them dynamically in pipeline jobs.
   • BEmbedding secrets in container images so they are available at runtime.
   • CSharing secrets via email to team members who need them.
   • DHardcoding secrets directly in the pipeline configuration file for simplicity.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A team wants to improve their security posture by learning from vulnerabilities found in production. Which feedback loop is most effective in a DevSecOps pipeline?

   • AWait for the next quarterly security review to discuss the alert.
   • BSend an email to the security team only, who will manually inform developers.
   • CLog the alert in a file that developers can check if they remember.
   • DAutomatically create a work item for the development team when a security alert is triggered in production.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which practice is an example of incorporating security monitoring into a CI/CD pipeline?

   • ADisabling logging in production to reduce performance overhead.
   • BCollecting and analyzing runtime security logs from the deployed application and sending alerts to the team.
   • CUsing the same monitoring dashboard for all applications without customization.
   • DRunning a SAST scan once before the initial release and never again.
   Reveal Solution Discussion Select an answer first