Role of DevSecOps in the CI/CD Pipeline DSE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which of the following is a core principle of DevSecOps?

   • AAutomating security checks so they run consistently and continuously within the CI/CD pipeline.
   • BEliminating all security tools to reduce complexity.
   • CKeeping security a separate function that only runs after the pipeline completes.
   • DPerforming all security testing manually to ensure thorough analysis.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A regulated company must maintain an audit trail of who approved each production deployment. They also want to minimize the time developers spend waiting for approvals. The compliance team requires that the approver be a different person from the developer who triggered the deployment. Which pipeline design best balances these constraints?

   • AAutomatically approve deployments if the build passed all security checks.
   • BRequire the same developer who triggered the deployment to approve it in the same session.
   • CUse a shared approval account that any team member can use.
   • DUse a manual approval gate that requires any user with the 'deployment approver' role to approve, and log the approver's identity.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company's pipeline uses a central build server that stores secrets for multiple projects. A developer accidentally commits a secret to a public repository. The security team wants to rotate the secret immediately and also prevent similar incidents. Which combination of actions best addresses both the immediate incident and the root cause?

   • AChange the repository from public to private without revoking the secret.
   • BDelete the commit history from the public repository and do nothing else.
   • COnly revoke the leaked secret and continue using the same secret-management process.
   • DRevoke the leaked secret, add a secret-scanning tool to the pipeline, and enforce pre-commit hooks that block secrets from being committed.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company is building a CI/CD pipeline for a web application. They want to ensure that security checks are performed at the right stages. Which security control is most appropriate to integrate during the build stage?

   • ADynamic application security testing (DAST) against a running instance.
   • BStatic application security testing (SAST) on the source code.
   • CInteractive application security testing (IAST) during runtime.
   • DRuntime application self-protection (RASP) on the production server.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A team's pipeline fails frequently because the SAST tool reports many false positives. Developers have started ignoring security scan results, and real vulnerabilities are slipping through. The team wants to restore trust in the security feedback without losing the ability to catch genuine issues. Which approach is most effective?

   • ASend SAST reports only to the security team and not to developers.
   • BTune the SAST rules to suppress known false positives, then track the rate of false positives versus true positives over time.
   • CKeep the SAST tool but fail the build on every finding, regardless of severity.
   • DRemove the SAST tool from the pipeline and rely on manual code reviews.
   Reveal Solution Discussion Select an answer first