Role of DevSecOps in the CI/CD Pipeline DSE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   In which CI/CD pipeline stage would you typically integrate a static application security testing (SAST) tool?

   • ADuring the post-mortem review after an incident.
   • BDuring the production monitoring stage, after the application is deployed.
   • CDuring the requirements gathering phase, before any code exists.
   • DDuring the build/compile stage, where source code is available for analysis.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A team wants to ensure that security issues found in production are quickly addressed in future releases. Which practice is most effective?

   • AHave the security team manually email developers about each vulnerability.
   • BIntegrate security monitoring with the CI/CD pipeline to automatically create work items for new vulnerabilities.
   • CWait for the next sprint planning meeting to discuss security issues.
   • DSend a monthly security report to the development team.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company has a CI/CD pipeline that uses a shared service account for all deployments. An auditor requires that every deployment be attributable to a specific individual. The team wants to maintain deployment speed. What is the best solution?

   • AKeep the shared service account but add a manual note in the deployment log stating who triggered the deployment.
   • BDisable all automated deployments and require manual deployments by an administrator.
   • CUse a shared service account but rotate its password weekly.
   • DUse individual user accounts for pipeline triggers and deployments, and configure the pipeline to record the user identity in deployment logs.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company's CI/CD pipeline is hosted on a shared infrastructure. They need to ensure that one team's pipeline cannot access another team's secrets. Which control is most effective?

   • AUse the same service account for all pipelines to simplify management.
   • BEmbed secrets in the pipeline configuration and rely on the CI system's log redaction.
   • CStore all secrets in a single shared vault with a common access policy.
   • DUse separate namespaces or projects with role-based access control (RBAC) to isolate pipelines and secrets.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A financial services company must demonstrate to auditors that every code change was reviewed and that security scans ran before production deployment. Which pipeline practice best supports this compliance requirement?

   • AAllow developers to merge directly to main and run security scans only when a release is scheduled.
   • BEnable branch protection requiring pull request reviews and configure the pipeline to run SAST and dependency scans on every merge.
   • CStore all pipeline logs in a central SIEM but do not enforce any review or scan gates.
   • DUse a single shared admin account for all pipeline configuration changes.
   Reveal Solution Discussion Select an answer first