DevSecOps Pipeline, Strategy, and Tools ECDE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A startup is building its first DevSecOps pipeline. They have a small team and limited budget. They need to comply with SOC 2, which requires vulnerability scanning and change management. Which strategy is most appropriate for their situation?

   • ADefer security testing until after SOC 2 audit to save time.
   • BImplement a full suite of security tools from the start, including SAST, DAST, and container scanning, to ensure comprehensive coverage.
   • CStart with a minimal pipeline that includes automated SAST and dependency scanning, and add more tools as the team matures.
   • DUse only manual security reviews before each release to avoid tooling costs.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A financial services firm is adopting DevSecOps. Their CI/CD pipeline currently runs unit tests and builds artifacts in about 12 minutes. The security team insists on running a full SAST scan and a DAST scan against a staging environment before every production deployment. The full SAST scan takes 18 minutes and the DAST scan takes 25 minutes. The release manager wants to maintain a deployment frequency of at least four times per day. What is the most effective approach to integrate these security scans without disrupting the delivery cadence?

   • ARun the full SAST scan on every commit in parallel with the build, and run the DAST scan nightly against the staging environment, failing the production deployment if either scan reports a critical finding.
   • BRun the DAST scan on every commit in parallel with the build, and run the SAST scan only when a release candidate is created.
   • CRun both the SAST and DAST scans sequentially in the pipeline after the build, and accept that the deployment frequency will drop to twice per day.
   • DSkip the DAST scan entirely and rely on the SAST scan to catch all vulnerabilities before production deployment.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company's DevSecOps pipeline uses a shared build server. The pipeline has access to a production database. The security team is concerned about the risk of a compromised build server being used to access the production database. Which control is most effective in mitigating this risk?

   • ADisable all logging on the build server to prevent attackers from finding the credentials.
   • BUse short-lived credentials for the pipeline's access to the production database, and restrict the database access to only the required operations.
   • CStore the production database credentials in the build server's configuration file.
   • DAllow the build server to access the production database only during business hours.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Why is audit logging important in a DevSecOps pipeline?

   • AIt replaces the need for security testing
   • BIt speeds up the pipeline by reducing the amount of data stored
   • CIt automatically fixes security vulnerabilities
   • DIt provides a record of pipeline activities for compliance and security investigations
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the primary benefit of orchestrating security checks within a DevSecOps pipeline?

   • AEliminating the need for any security testing
   • BAllowing security checks to be skipped when the pipeline is busy
   • CReplacing the need for developer involvement in security
   • DEnsuring security checks run consistently and in the correct order
   Reveal Solution Discussion Select an answer first