DevSecOps Pipeline, Strategy, and Tools ECDE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which practice is essential for securing the DevSecOps pipeline itself?

   • ASharing pipeline credentials among all team members
   • BDisabling audit logging to reduce overhead
   • CUsing a dedicated secrets management solution to store credentials
   • DStoring secrets in plain text in the pipeline configuration
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A DevSecOps team has a pipeline that runs SAST, DAST, and dependency scanning. The team notices that the pipeline often fails due to flaky DAST tests, causing delays. They want to maintain security coverage without blocking delivery on false positives. Which approach best addresses this?

   • AIncrease the timeout for DAST to reduce flakiness, but do not track any metrics.
   • BRemove DAST from the pipeline and run it only manually before major releases.
   • CConfigure DAST to allow a limited number of retries before failing, and track flaky test rates as a metric.
   • DIgnore DAST failures and always allow the pipeline to pass.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A team is building a DevSecOps pipeline for a new application. They want to ensure that security is integrated into every stage. Which of the following is the best example of integrating security into the 'deploy' stage of the pipeline?

   • AUsing a dependency scanner to check for vulnerable libraries in the source code.
   • BSending a notification to the security team after the deployment is complete.
   • CVerifying the integrity of the deployment artifacts and ensuring that the deployment target is configured securely.
   • DRunning a SAST scan on the source code before the build.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A team is designing a DevSecOps pipeline for a mobile application. They want to integrate security checks into the pipeline. Which of the following is the best example of a security check in the 'build' stage of the pipeline?

   • ARunning a dependency scan on the application's libraries and frameworks.
   • BReviewing the application's source code for security vulnerabilities.
   • CMonitoring the application's runtime behavior in production.
   • DPerforming a penetration test on the application's API endpoints.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   When formulating a DevSecOps pipeline strategy, what is the primary purpose of defining 'security gates'?

   • ATo slow down the pipeline to allow manual security reviews
   • BTo provide automated checkpoints that must pass before the pipeline proceeds
   • CTo replace the need for compliance auditing
   • DTo ensure that security checks are performed only at the end of the pipeline
   Reveal Solution Discussion Select an answer first