Role of DevSecOps in the CI/CD Pipeline DSE Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A team is building a CI/CD pipeline and wants to ensure that secrets are not exposed in build logs. They also want to maintain the ability to rotate secrets quickly. Which practice is most effective?

   • AStore secrets in the pipeline configuration file and rely on log redaction.
   • BUse a secrets management tool to inject secrets as environment variables and configure the pipeline to mask them in logs.
   • CUse hardcoded secrets in the source code and avoid logging altogether.
   • DUse a shared secret for all environments and change it monthly.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A healthcare organization must ensure that patient data is protected and that all software changes are traceable. Which combination of DevSecOps practices best supports this requirement?

   • AAutomated security testing only, without logging or access controls.
   • BAutomated security testing, audit logging of all pipeline activities, and access controls on the pipeline.
   • CManual security reviews and storing logs in a shared folder.
   • DAccess controls only, without security testing or logging.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A team notices that security vulnerabilities are being found late in the release cycle, causing rework. They want to use feedback from production monitoring to improve early detection. Which approach best supports this goal?

   • ASend security scan reports only to the security team and not to developers.
   • BDisable production monitoring to reduce noise and focus only on pre-production scans.
   • CAdd a pipeline step that ingests production security metrics and updates the team's backlog with recurring vulnerability patterns.
   • DRequire all security findings to be fixed in the same release they are found, regardless of severity.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   What does the DevSecOps principle of 'shifting security left' mean in practice?

   • AMoving security testing to a separate, dedicated phase after deployment to avoid slowing down developers.
   • BDelegating all security responsibilities to a dedicated security team that reviews code after each release.
   • CPerforming security activities earlier in the software development lifecycle, such as during design and coding, rather than only at the end.
   • DUsing only open-source security tools because they are more effective than commercial ones.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A company's CI/CD pipeline uses a shared runner that executes build jobs. The security team is concerned that a malicious pull request could modify the runner's configuration or access secrets. Which measure best mitigates this risk?

   • AUse separate runners for untrusted pull request builds and restrict their access to secrets.
   • BDisable all logging for pull request builds to hide any malicious activity.
   • CAllow pull request builds to run on the same runner as protected branches to save resources.
   • DStore secrets in the pipeline definition file so they are available to all runners.
   Reveal Solution Discussion Select an answer first