Building a CI/CD Pipeline ECDE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A product team wants to release new features frequently but also wants to ensure that security vulnerabilities are caught before production. They are considering whether to use continuous delivery or continuous deployment. The pipeline currently runs DAST in staging. The team wants to have a human review security reports before production releases. What is the best approach?

   • AUse continuous deployment: automatically deploy to production after DAST passes, without manual review.
   • BUse manual deployment to production after every DAST scan, without a staging environment.
   • CUse continuous delivery: automatically deploy to staging, run DAST, and require a manual approval before deploying to production.
   • DUse continuous integration only: run DAST on every commit but do not deploy automatically.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A DevSecOps team is integrating DAST into a pipeline for a web application that uses a third-party payment gateway. The DAST scanner must not send malicious payloads to the payment gateway. The team wants to run DAST automatically in staging. What is the best way to handle this constraint?

   • ADisable DAST for the entire application to avoid risk.
   • BRun DAST only in production where the payment gateway is real.
   • CConfigure the DAST scanner to exclude the payment gateway domain and use a mock or sandbox for payment-related requests.
   • DRun DAST without any exclusions and rely on the scanner's safety features.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is a recommended access control practice for CI/CD pipeline execution?

   • ADisable authentication for the CI/CD system to make it easier for tools to integrate.
   • BGrant all developers full administrative access to the CI/CD system to avoid delays.
   • CShare a single service account for all pipeline jobs to simplify management.
   • DUse role-based access control (RBAC) to grant permissions based on job responsibilities.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company wants to integrate DAST into their CI/CD pipeline but is concerned about the time it takes to run a full scan. They want to provide fast feedback to developers without waiting for the entire scan. Which approach should they take?

   • ARun the full DAST scan on every commit, accepting the longer pipeline time.
   • BRun DAST only on the production environment after deployment.
   • CSkip DAST entirely and rely on SAST for security testing.
   • DRun a subset of DAST tests on every commit and a full scan on a nightly schedule or before release.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A DevSecOps team has integrated DAST into their pipeline. The DAST scan runs on every merge to the main branch and takes 30 minutes. The team wants to monitor the pipeline's performance and be alerted if the DAST stage exceeds 45 minutes. What should be configured?

   • ACheck the DAST report manually after each merge to see if it took longer.
   • BIncrease the DAST timeout to 60 minutes and ignore the duration.
   • CSet up a pipeline monitoring tool that tracks stage duration and triggers an alert when the DAST stage exceeds 45 minutes.
   • DRun DAST only on release branches to reduce pipeline time.
   Reveal Solution Discussion Select an answer first