DevSecOps Pipeline, Strategy, and Tools ECDE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which approach best balances speed, security, and compliance when developing a DevSecOps pipeline strategy?

   • APerforming all security checks manually before each release
   • BRunning security checks only in production to reflect real-world conditions
   • CUsing a separate security pipeline that runs after the main pipeline
   • DAutomating security checks and integrating them into each pipeline stage
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which security testing type is BEST suited for integration into the early stages of a CI/CD pipeline?

   • ADynamic application security testing (DAST)
   • BPenetration testing
   • CStatic application security testing (SAST)
   • DRuntime application self-protection (RASP)
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A large enterprise is planning to implement a DevSecOps pipeline across multiple development teams. Each team uses a different CI/CD tool (Jenkins, GitLab CI, and GitHub Actions). The security team wants a unified view of security findings across all pipelines. They are considering: (1) standardizing on a single CI/CD tool, (2) using a centralized security orchestration platform, or (3) having each team report findings to a common dashboard. Which approach is most effective in achieving a unified view while minimizing disruption to the teams?

   • AHave each team manually export their security findings to a shared spreadsheet on a weekly basis.
   • BRequire each team to use the same set of security tools, even if they use different CI/CD tools.
   • CUse a centralized security orchestration platform that integrates with all three CI/CD tools and aggregates findings into a single dashboard.
   • DStandardize on a single CI/CD tool across all teams to simplify integration and reporting.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   When evaluating a security tool for a pipeline, which feature directly supports automation?

   • AA command-line interface (CLI) and API for programmatic control
   • BA graphical user interface (GUI) for manual configuration
   • CA built-in report viewer
   • DA cloud-based dashboard
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A development team uses a CI/CD pipeline that builds and deploys a web application. They want to integrate DAST scanning into the pipeline. The DAST scan requires the application to be running in a test environment. What is the best way to integrate DAST into the pipeline?

   • ADeploy the application to a temporary staging environment, run the DAST scan against it, and then tear down the environment.
   • BUse a static analysis tool to simulate the DAST scan without deploying the application.
   • CRun the DAST scan against the production environment after the deployment is complete.
   • DRun the DAST scan on the source code in the build stage, before the application is deployed.
   Reveal Solution Discussion Select an answer first