DevSecOps Pipeline, Strategy, and Tools ECDE Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A multinational company must comply with GDPR, which restricts where personal data can be processed. Their DevSecOps pipeline uses a cloud-based CI service that runs in a region outside the EU. The security team wants to keep the pipeline fast while ensuring compliance. Which strategy best meets both requirements?

   • AUse a self-hosted CI runner located in an EU region, and configure the pipeline to use that runner for all builds.
   • BUse the cloud CI service as-is, but encrypt all data in transit and at rest.
   • CMove the entire pipeline to an on-premises data center outside the EU to maintain control.
   • DUse a cloud CI service in the EU region, but allow builds to run in other regions if the queue is long.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which practice is essential for automating security checks in a pipeline?

   • ARunning security tools manually on a weekly basis
   • BUsing scripts or plugins to invoke security tools as part of the pipeline
   • CPerforming security checks only after deployment
   • DRequiring a security engineer to approve each build
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which security activity is most commonly associated with the build stage of a DevSecOps pipeline?

   • APenetration testing
   • BStatic application security testing (SAST)
   • CRuntime threat detection
   • DCompliance auditing
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A company's DevSecOps pipeline is hosted on a shared CI infrastructure. The security team is concerned about the integrity of build artifacts and wants to ensure that artifacts deployed to production are the ones that passed all security checks. Which control best addresses this concern?

   • ARely on the CI system's build logs to verify that the artifact is unchanged.
   • BStore build artifacts in a shared network drive accessible to all teams.
   • CSign the build artifacts with a private key and verify the signature before deployment.
   • DUse the same artifact for all environments to simplify the pipeline.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   What is the primary purpose of monitoring pipeline metrics in a DevSecOps environment?

   • ATo replace the need for security audits
   • BTo automate the deployment process
   • CTo evaluate the security posture and identify areas for improvement
   • DTo track developer productivity only
   Reveal Solution Discussion Select an answer first