Understanding DevSecOps DSE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An organization wants to implement continuous monitoring as part of its DevSecOps strategy. They currently monitor only the production environment and review logs weekly. Which change would best align with DevSecOps continuous monitoring practices?

   • AMonitor only the CI/CD pipeline for security issues.
   • BKeep monitoring production only but increase log review to daily.
   • CMonitor development, staging, and production environments in real time, with automated alerts for suspicious activity.
   • DUse a third-party service to perform monthly vulnerability scans on production.
   Reveal Solution Discussion Select an answer first
2. 22expert · medium

   A company is evaluating whether to adopt DevSecOps. They currently have a strong security team that performs thorough manual reviews before each release. The releases are infrequent but highly reliable. The company wants to increase release frequency without compromising security. Which factor is most important in deciding whether DevSecOps can help?

   • AThe company's budget for new security tools.
   • BThe ability to automate security checks without losing the depth of manual reviews.
   • CThe number of security team members available to review code.
   • DThe programming languages used in the application stack.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is a key principle of DevSecOps?

   • AAutomation of security checks within the CI/CD pipeline
   • BSecurity is the sole responsibility of the security team
   • CSecurity testing is performed manually after deployment
   • DSecurity is applied only during the requirements gathering phase
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A software company wants to reduce the number of vulnerabilities reaching production. They currently run static analysis only during a dedicated security phase at the end of the development cycle. The team wants to adopt a DevSecOps practice that provides faster feedback to developers while maintaining a clear audit trail. Which practice should they implement?

   • ARun SAST tools as part of every pull request and store results in the CI system.
   • BUse a spreadsheet to track SAST findings and assign them to developers manually.
   • CSchedule a nightly SAST scan on the main branch only.
   • DReplace SAST with penetration testing before each release.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company wants to implement continuous security monitoring for its cloud infrastructure. They have a large number of resources and want to detect misconfigurations and unauthorized changes in real time. They also want to minimize the operational overhead of managing the monitoring solution. Which approach best meets these requirements?

   • ADeploy a custom script on each virtual machine that periodically checks configuration files and sends email alerts.
   • BUse a third-party tool that requires a separate agent to be installed on every resource.
   • CUse a cloud-native security monitoring service that automatically collects and analyzes configuration changes and alerts on policy violations.
   • DHave the operations team manually review cloud configuration changes on a weekly basis.
   Reveal Solution Discussion Select an answer first