DevSecOps Pipeline, Strategy, and Tools ECDE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A financial services company is designing a DevSecOps pipeline that must meet PCI DSS requirements. The compliance team requires that all code changes be traceable to a ticket and that production deployments be approved by a security officer. The development team wants to maintain a fast release cadence. Which strategy best balances these requirements?

   • AUse a separate pipeline for production that runs only nightly, with no manual approval, to reduce risk.
   • BRequire manual approval at every stage of the pipeline to ensure full compliance.
   • CAutomate the entire pipeline including production deployment, and rely on post-deployment audits to ensure compliance.
   • DAutomate the pipeline up to the production deployment step, requiring a manual security approval before the final deployment.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   In a DevSecOps pipeline, which stage is typically the FIRST point where automated security testing is introduced?

   • ARelease stage
   • BMonitor stage
   • CDeploy stage
   • DCommit stage
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A team is designing a DevSecOps pipeline for a web application. They want to integrate security checks at the earliest possible stage to reduce the cost of fixing vulnerabilities. Which security check should be performed first in the pipeline?

   • ARun a DAST scan against a staging environment after the application is deployed.
   • BRun a dependency scan on the final container image after the image is built.
   • CRun a software composition analysis (SCA) scan on the production environment after the release.
   • DRun a SAST scan on the source code immediately after the developer commits the code and before the build process begins.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A DevSecOps team wants to ensure that security checks are not skipped or modified by developers. They use a Jenkins pipeline defined in a Jenkinsfile stored in the repository. Which approach best enforces the integrity of the pipeline?

   • AAllow developers to edit the Jenkinsfile freely to add or remove security stages as needed.
   • BRun security checks only on the main branch to reduce the chance of modification.
   • CUse a shared library for security stages and enforce that the pipeline uses the library via a mandatory plugin or policy.
   • DStore the Jenkinsfile only on the Jenkins server and do not version-control it.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A team is building a DevSecOps pipeline and wants to ensure that security checks are executed consistently on every code change. They have a Jenkins pipeline that currently runs build and test stages. Which approach best achieves consistent security validation?

   • ARun security tools manually on a weekly basis from a separate server.
   • BCreate a separate security pipeline that runs only when a developer triggers it manually.
   • CAdd a security stage to the existing Jenkins pipeline that runs the same set of security tools on every build.
   • DUse a post-commit hook on the source repository to run security tools outside the CI pipeline.
   Reveal Solution Discussion Select an answer first