Role of DevSecOps in the CI/CD Pipeline DSE Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A team has implemented security scanning in their CI/CD pipeline. However, developers are ignoring the security warnings because they are not integrated into their workflow. Which improvement would most effectively increase the adoption of security feedback?

   • ASend a weekly email digest of all security findings to the development team.
   • BOnly show security findings to the security team, who will fix them.
   • CIntegrate security scan results directly into the developer's IDE and pull request comments.
   • DRequire developers to run security scans manually before pushing code.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A healthcare organization must ensure that production deployments are approved by a security officer and that all deployment actions are logged for compliance. Which pipeline configuration best satisfies this requirement?

   • AAllow any developer to approve production deployments and keep logs only for failed deployments.
   • BAutomate the production deployment without any approval step and rely on post-deployment logs.
   • CUse a shared service account for all deployments and disable logging to reduce storage costs.
   • DAdd a manual approval gate before the production deployment stage and enable audit logging on the pipeline.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A financial company must demonstrate to auditors that every code change was reviewed and security tested before production deployment. Which DevSecOps practice best supports this compliance requirement?

   • AAutomatically capture and store pipeline logs, test results, and approval records for every deployment.
   • BAllow developers to bypass security checks if they are confident in their code.
   • CRun security tests only after production deployment to avoid delays.
   • DManually document security reviews in a separate spreadsheet after each release.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A company is moving from a traditional security review process to DevSecOps. The security team is concerned about losing control. The development team wants to release faster. Which approach best addresses both concerns?

   • AHave the security team manually approve every release.
   • BDefine security policies as code and enforce them automatically in the pipeline, with security team oversight of policy changes.
   • CLet developers decide which security checks to run.
   • DRemove all security gates and rely on post-release monitoring.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A company uses a CI/CD platform where pipeline definitions are stored in a Git repository. The security team wants to prevent unauthorized changes to the pipeline configuration. Which control is most effective?

   • AStore pipeline definitions in a private repository with no review process.
   • BAllow only the CI/CD platform's built-in editor to modify pipeline definitions.
   • CUse a shared service account to commit all pipeline changes.
   • DRequire pull request reviews and enforce branch protection rules on the repository containing the pipeline definitions.
   Reveal Solution Discussion Select an answer first