CI/CD Pipeline ECDE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A development team uses GitHub for source control and wants to automatically run unit tests and build a Docker image whenever a pull request is opened, but only deploy to staging after the pull request is merged to the main branch. They want the pipeline definition to be reviewed and versioned like code. Which approach should they use?

   • AUse a Git hook in each developer's local repository to run tests and deploy to staging on commit.
   • BCreate a GitHub Actions workflow file in the repository with separate jobs triggered by pull_request and push events.
   • CConfigure a Jenkins job that polls the repository every minute and runs the same build and deploy steps for any branch change.
   • DSet up a webhook in GitHub that triggers an external CI tool to run tests on every push to any branch.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A DevSecOps team is implementing a CI/CD pipeline for a regulated application. They must ensure that secrets are not exposed in logs, that only authorized personnel can approve production deployments, and that the pipeline configuration is auditable. They are using Jenkins. Which set of controls should they implement?

   • AStore secrets in a properties file in the workspace, allow any developer to trigger production deployments, and document the pipeline in a wiki.
   • BUse environment variables for secrets, disable log masking, and use a shared Jenkinsfile that anyone can edit.
   • CUse a third-party secrets manager, allow all developers to approve production deployments, and store the Jenkinsfile in a shared drive.
   • DUse Jenkins credentials store for secrets, mask secrets in build logs, require a user with the 'admin' role to approve production jobs, and store the Jenkinsfile in version control.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A company's CI pipeline produces signed software artifacts that are deployed to production. They need to ensure that the artifacts are tamper-proof and that the deployment pipeline can verify the artifact's integrity and origin. Which practice should they implement?

   • AUse a checksum file stored alongside the artifact in the same repository.
   • BStore the artifact in a public repository and rely on the repository's access controls.
   • CEmbed a timestamp in the artifact filename and verify it during deployment.
   • DSign the artifact with a private key during the build and have the deployment pipeline verify the signature using the corresponding public key.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   An e-commerce platform must deploy a new version with zero downtime. The operations team wants to be able to instantly roll back if a critical issue is detected after deployment. Which deployment strategy best meets these requirements?

   • ACanary deployment that sends a small percentage of traffic to the new version.
   • BRecreate deployment that terminates all old instances before starting new ones.
   • CRolling deployment that gradually replaces instances of the old version.
   • DBlue-green deployment with the old version kept ready for immediate switchback.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company's CI pipeline produces multiple artifacts (e.g., a web application package and a database migration script). The deployment pipeline needs to ensure that the versions of these artifacts are consistent with each other. What is the best practice?

   • AStore artifacts in different repositories without any version correlation.
   • BStore each artifact separately with its own version based on the time of creation.
   • CStore all artifacts from the same build under a common version identifier in the artifact repository.
   • DDo not version artifacts; always use the latest available version.
   Reveal Solution Discussion Select an answer first