Role of DevSecOps in the CI/CD Pipeline DSE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which automated security testing technique is used to identify known vulnerabilities in third-party libraries and dependencies?

   • ASoftware Composition Analysis (SCA)
   • BStatic Application Security Testing (SAST)
   • CPenetration testing
   • DDynamic Application Security Testing (DAST)
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A development team is new to DevSecOps and wants to adopt the principle of shifting security left. They currently run security scans only after the application is fully built. Which change best aligns with this principle?

   • ARun security scans only in production to test the real environment.
   • BIntegrate SAST and secret scanning into the commit and build stages so findings are available before the artifact is produced.
   • CMove all security testing to a separate weekly manual review process.
   • DKeep security scans only in the post-build stage to avoid slowing down development.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A team wants to automatically test a web application for common runtime vulnerabilities such as misconfigurations and authentication flaws after it is deployed to a staging environment. Which tool category should they integrate into the deploy stage?

   • AA Static Application Security Testing (SAST) tool that analyzes source code.
   • BA software composition analysis (SCA) tool that checks dependencies.
   • CA container image scanner that checks for base image vulnerabilities.
   • DA Dynamic Application Security Testing (DAST) tool that scans the running application.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   How does a security monitoring and feedback loop contribute to continuous improvement in a DevSecOps pipeline?

   • ABy feeding security findings from production back into the pipeline to improve future builds.
   • BBy requiring manual review of every security alert before the pipeline can proceed.
   • CBy storing monitoring data in a separate system that is not accessible to developers.
   • DBy automatically blocking all traffic to the application if any vulnerability is found.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which automated security testing technique is performed against a running application to identify vulnerabilities such as SQL injection or cross-site scripting?

   • ADynamic Application Security Testing (DAST)
   • BSoftware Composition Analysis (SCA)
   • CInfrastructure as Code (IaC) scanning
   • DStatic Application Security Testing (SAST)
   Reveal Solution Discussion Select an answer first