DevSecOps Pipeline, Strategy, and Tools ECDE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A DevSecOps team is building a pipeline for a microservices application. They want to ensure that container images are scanned for vulnerabilities before they are pushed to the production registry. They also want to enforce that only images that pass the scan can be deployed. Which approach best achieves this goal?

   • AUse a runtime security tool in the production environment to monitor containers for suspicious activity and block them if needed.
   • BScan the container image in the production registry on a nightly basis and alert the security team if vulnerabilities are found.
   • CAdd a container image scan step in the pipeline after the image is built, and if the scan fails, fail the pipeline and do not push the image to the production registry.
   • DRequire developers to run the image scan locally on their machines before pushing the code to the repository.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A healthcare organization is implementing a DevSecOps pipeline for a patient-facing application. The compliance team requires that all code changes be traceable to a ticket, that no production deployment occurs without an approved security review, and that audit logs be retained for seven years. The engineering team wants to deploy multiple times per day. The current manual security review takes two days. Which strategy best balances the compliance requirements with the engineering team's velocity?

   • ARequire the security team to review only the code changes that are larger than 500 lines of code, and automate the review for smaller changes.
   • BDeploy to production immediately after automated tests pass, and have the security team perform the review after the deployment is complete.
   • CKeep the manual two-day security review for every change, but run it in parallel with the build and test stages to reduce the overall lead time.
   • DAutomate the security review by embedding SAST, dependency scanning, and policy-as-code checks into the pipeline, and require a human approval only for changes that trigger high-severity findings or policy violations.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A DevSecOps team has implemented a pipeline with SAST, DAST, and dependency scanning. The security team wants to measure the effectiveness of the pipeline. They have proposed the following metrics: (1) number of vulnerabilities found in production, (2) time to remediate a vulnerability, (3) number of builds that fail due to security checks, and (4) percentage of code coverage by SAST. Which combination of metrics best measures the effectiveness of the security controls in the pipeline?

   • AMetrics 3 and 4, because they measure how often the pipeline blocks insecure code and how much code is scanned.
   • BMetrics 1 and 4, because they measure the reduction of vulnerabilities and the thoroughness of the SAST scan.
   • CMetrics 1 and 2, because they directly measure the outcome of the security controls in reducing production risk and improving response time.
   • DMetrics 2 and 3, because they measure the team's responsiveness and the pipeline's enforcement of security checks.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A team is implementing a DevSecOps pipeline. They want to ensure that security checks are run consistently on every build. They are considering using a pipeline orchestration tool. What is the primary benefit of using an orchestration tool for this purpose?

   • AIt eliminates the need for any manual security review.
   • BIt provides a graphical interface for developers to manually run security scans.
   • CIt ensures that the same security checks are executed in the same order on every build, providing consistent and reliable security validation.
   • DIt automatically fixes all security vulnerabilities found by the scans.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A DevSecOps team is selecting a tool for dependency scanning. They have two options: Tool A is a commercial tool that integrates with their CI/CD platform and provides a centralized dashboard. Tool B is an open-source tool that can be run as a command-line utility. The team has a small budget but a strong preference for automation and centralized reporting. Which tool should they choose?

   • ATool B, because it is open source and has no licensing cost, which is the most important factor given the small budget.
   • BTool B, because it can be integrated into the pipeline using a shell command, and the team can build a custom dashboard.
   • CTool A, because the CI/CD integration and centralized dashboard align with the team's preference for automation and reporting.
   • DTool A, because commercial tools are always more accurate than open-source tools.
   Reveal Solution Discussion Select an answer first