Building a CI/CD Pipeline ECDE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A DevSecOps engineer is integrating DAST into a Jenkins pipeline for a web application. The application is deployed to a staging environment after the build and unit tests pass. The team wants to run DAST against the running application and fail the pipeline if critical vulnerabilities are found. Which pipeline stage should the DAST job be placed in, and what should trigger the failure?

   • AAfter the deployment to staging, with a post-build action that parses the DAST report and marks the build as failed if any critical findings exist.
   • BAfter deployment, but only record the results in the build log without failing the pipeline.
   • CBefore the build, scanning the source code repository for vulnerabilities.
   • DDuring the build, using a plugin that scans the compiled binaries for known vulnerabilities.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company is moving from a manual release process to an automated pipeline. They want to achieve continuous delivery but are not ready for continuous deployment due to regulatory approval requirements. They also need to ensure that the pipeline is secure and that only authorized personnel can approve production releases. Which pipeline design should they implement?

   • AAutomate all stages up to production, and require a manual approval step with multi-factor authentication for the final deployment.
   • BAllow any developer to approve production releases to speed up the process.
   • CKeep the manual release process but add automated tests before release.
   • DAutomate everything including production deployment, and rely on post-deployment monitoring.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   In a CI/CD pipeline, at which stage is DAST typically executed?

   • ADuring the source code commit stage, before any build occurs.
   • BOnly in production, after the final release.
   • CDuring the build stage, before the application is compiled.
   • DAfter the application is deployed to a test or staging environment.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A team is building a CI/CD pipeline for a microservices architecture. Each microservice has its own repository and pipeline. They want to ensure that a change in one service does not break the integration with other services. Which approach should they use?

   • AAdd an integration testing stage that deploys all services to a shared environment and runs end-to-end tests.
   • BRun only unit tests for each service independently and deploy to production.
   • CUse a single pipeline for all services, building them together in one job.
   • DSkip integration testing and rely on monitoring in production.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A DevSecOps engineer is designing a pipeline for a critical application. The pipeline must run unit tests, integration tests, and DAST. The team wants to minimize the overall pipeline time while ensuring that all tests run. Which orchestration strategy should they use?

   • ARun DAST in parallel with unit tests before the build.
   • BRun unit tests and integration tests in parallel after the build, then run DAST after the deployment to a test environment.
   • CRun all tests sequentially in the order: unit, integration, DAST, after deployment.
   • DRun only DAST and skip unit and integration tests to save time.
   Reveal Solution Discussion Select an answer first