Building a CI/CD Pipeline ECDE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company has a CI/CD pipeline that deploys a web application to a staging environment. They want to integrate DAST but are concerned about the scan interfering with the staging environment's performance and causing false positives. The staging environment is shared with other teams. Which approach should they take?

   • ADeploy a dedicated staging environment for DAST scanning, and configure the scanner to exclude known false-positive patterns.
   • BRun DAST against the production environment to get the most accurate results.
   • CRun DAST on the shared staging environment during off-peak hours.
   • DSkip DAST and rely on penetration testing once a year.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A DevSecOps team has integrated DAST into their CI/CD pipeline. They want to monitor the pipeline's performance and security results over time. Which set of metrics should they track to gain the most useful feedback?

   • AOnly the number of builds that fail due to compilation errors.
   • BPipeline duration, DAST scan time, number of vulnerabilities found, and trend of critical findings over time.
   • CServer CPU usage and memory consumption during the build.
   • DNumber of commits per day and number of developers on the team.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is an example of a feedback mechanism in a CI/CD pipeline?

   • AStoring build logs in a file that no one reads.
   • BAutomatically rolling back to a previous version without notifying anyone.
   • CDisabling the pipeline when a test fails.
   • DSending an email or notification to the development team when a build fails.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A DevSecOps team is designing a pipeline for a large monorepo with multiple independent services. The pipeline must build and test only the services that changed, but still run DAST against the entire staging environment. The team wants to minimize pipeline time while maintaining security coverage. What is the best approach?

   • ABuild and test only changed services, and run DAST only on those services in staging.
   • BUse change-based triggering to build and test only affected services, then deploy all services to staging and run DAST against the full environment.
   • CBuild and test all services on every change, then run DAST only on the changed services.
   • DUse a single pipeline that builds and tests all services, and run DAST only on release candidates.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is a security best practice for managing secrets (e.g., API keys, passwords) in a CI/CD pipeline?

   • AStore secrets in environment variables defined in the pipeline configuration file.
   • BEncrypt secrets using a simple algorithm and store them in the pipeline script.
   • CUse a dedicated secret management tool (e.g., HashiCorp Vault) and reference secrets from the pipeline.
   • DCommit secrets to the version control repository so all team members have access.
   Reveal Solution Discussion Select an answer first