Building a CI/CD Pipeline ECDE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A DevSecOps engineer is configuring a CI/CD pipeline for a Python application. The pipeline needs to install dependencies, run tests, and deploy to a cloud environment. The team wants to ensure that the pipeline does not have write access to the production environment except during the deployment stage. What is the best way to achieve this?

   • AUse separate service accounts for build/test and deploy stages, granting the deploy account write access only to the production environment.
   • BGrant the build server full access to production and rely on the pipeline script to only use it during deployment.
   • CStore production credentials in the repository and use them only in the deploy stage.
   • DUse the same service account for all stages, but restrict its permissions in the pipeline configuration.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary purpose of integrating DAST into a CI/CD pipeline?

   • ATo analyze the source code for security flaws without executing the application.
   • BTo monitor the production environment for real-time attacks.
   • CTo scan container images for known vulnerabilities in dependencies.
   • DTo scan the running application for security vulnerabilities from an external perspective.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company is implementing a CI/CD pipeline for a mobile application. The pipeline must build the app, run unit tests, and then run DAST against the backend API that the app uses. The team wants to ensure that the backend is deployed before DAST runs. What is the correct pipeline stage order?

   • ABuild app → Run unit tests → Deploy backend to staging → Run DAST against the staging backend.
   • BRun unit tests → Build app → Run DAST → Deploy backend.
   • CRun DAST against the backend → Build app → Run unit tests → Deploy backend.
   • DBuild app → Deploy backend → Run unit tests → Run DAST.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A DevSecOps team is building a pipeline for a web application that must be deployed to multiple regions. The pipeline currently builds and tests the application, then deploys to one region. The team wants to deploy to other regions only if the first deployment is successful and passes a DAST scan. What is the best pipeline design?

   • ADeploy to region 1, then immediately deploy to regions 2 and 3 without waiting for DAST.
   • BRun DAST only in production after all regions are deployed.
   • CDeploy to all regions in parallel and run DAST only after all deployments are complete.
   • DUse a sequential deployment strategy: deploy to region 1, run DAST, and if successful, deploy to region 2 and region 3.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A team uses a CI/CD pipeline that pulls source code from a Git repository and builds a Docker image. The pipeline needs to push the image to a private container registry. The team wants to avoid storing the registry password in the pipeline configuration file. What is the best approach?

   • AUse a credential manager or secret vault integrated with the CI/CD system to inject the registry password at runtime.
   • BStore the registry password in the pipeline configuration file with a note that it is sensitive.
   • CUse the same password for all environments and hard-code it in the pipeline script.
   • DEmbed the registry password in the Dockerfile as a build argument.
   Reveal Solution Discussion Select an answer first