DevSecOps Pipeline, Strategy, and Tools ECDE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which metric is most useful for measuring the effectiveness of a DevSecOps pipeline?

   • ANumber of commits per day
   • BMean time to remediate (MTTR) security vulnerabilities
   • CTotal lines of code in the repository
   • DNumber of developers on the team
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A development team is integrating SAST into their CI/CD pipeline. The SAST tool is producing a high number of false positives, which is causing developers to ignore the results. What is the most effective way to address this issue?

   • ARemove the SAST scan from the pipeline because it is causing too much friction.
   • BRequire developers to fix every finding, including false positives, to ensure no vulnerability is missed.
   • CRun the SAST scan only on a nightly basis and review the results manually.
   • DTune the SAST tool's rules and configuration to reduce false positives, and establish a process for developers to mark findings as false positives.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A DevSecOps team wants to monitor the security posture of their pipeline. They have set up a dashboard showing the number of vulnerabilities found per build. Which additional metric would best help them identify whether the pipeline is improving security over time?

   • AThe trend of vulnerability density (vulnerabilities per thousand lines of code) over time.
   • BThe total number of builds executed per day.
   • CThe number of developers who have access to the pipeline.
   • DThe average build time in minutes.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the primary goal of integrating dependency scanning into a CI/CD pipeline?

   • ATo analyze the application's source code for logic errors
   • BTo monitor the application's runtime behavior
   • CTo identify known vulnerabilities in third-party libraries
   • DTo test the application's user interface for security flaws
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A DevSecOps team wants to measure the effectiveness of their pipeline's security gates. They currently track the number of vulnerabilities found in production. They also want to know whether the gates are catching issues before deployment. Which combination of metrics would provide the most useful insight?

   • AThe number of developers and the number of commits per day.
   • BThe number of security tools used and the number of vulnerabilities found in production.
   • CThe total number of builds and the average build time.
   • DThe number of vulnerabilities found in the pipeline per stage, and the number of vulnerabilities that reach production.
   Reveal Solution Discussion Select an answer first