Building a CI/CD Pipeline ECDE Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A team has a CI/CD pipeline that runs DAST on every merge to main. The DAST scan sometimes fails due to false positives, causing developers to ignore the results. The team wants to reduce false positives while maintaining security coverage. What is the best approach?

   • ATune the DAST scanner by adding false-positive exclusions and a review process for new findings, while keeping the scan in the pipeline.
   • BIgnore all DAST failures and only review the report at the end of the sprint.
   • CRemove DAST from the pipeline and run it manually once a month.
   • DIncrease the DAST scanner's sensitivity to catch more issues.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A DevSecOps team wants to set up monitoring for their CI/CD pipeline to alert on security scan failures and pipeline performance degradation. Which combination of tools and practices should they implement?

   • AIntegrate the pipeline with a monitoring tool like Prometheus and Grafana, and configure alerts for DAST failures and long build times.
   • BOnly check the pipeline logs manually at the end of the day.
   • CUse email notifications for every build, regardless of status.
   • DStore all pipeline logs in a file without any analysis.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   How do the build and test stages of a CI/CD pipeline typically interconnect?

   • AThe test stage generates the source code that the build stage compiles.
   • BThe build stage produces an artifact that the test stage uses as input for automated testing.
   • CThe build and test stages run independently and do not share any data or artifacts.
   • DThe test stage runs before the build stage to ensure code quality before compilation.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A company is implementing a CI/CD pipeline for a financial application. The pipeline must comply with an audit requirement that all changes to production be traceable to a specific commit and an authorized user. The team uses a shared CI/CD service account for deployments. What is the best way to meet the audit requirement?

   • ADisable direct access to production and allow only the CI/CD system to deploy, without logging user identity.
   • BUse a deployment pipeline that records the commit SHA and the identity of the user who triggered the pipeline, and store this in an immutable audit log.
   • CUse the shared service account and rely on the pipeline logs to show the deployment time.
   • DRequire manual approval for each deployment and record the approver's name in the pipeline configuration.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A company is setting up a CI/CD pipeline for a .NET application. They have a version control system, a build server, and a deployment target. The team wants to ensure that only artifacts that have passed all tests are deployed. What is the best practice?

   • AHave the build server deploy the artifact immediately after compilation, before tests run.
   • BStore artifacts on the build server's local disk and deploy them manually.
   • CDeploy directly from the version control system after tests pass.
   • DUse an artifact repository to store build artifacts with metadata linking them to the build and test results, and deploy only artifacts with a 'passed' status.
   Reveal Solution Discussion Select an answer first