DevSecOps Pipeline, Strategy, and Tools ECDE Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A company is implementing a DevSecOps pipeline for a legacy application that is critical to business operations. The application has a large amount of technical debt and many known vulnerabilities. The team has limited resources and cannot fix all vulnerabilities immediately. What is the most effective strategy for managing this situation?

   • AImplement a risk-based approach, prioritizing the remediation of critical and high-severity vulnerabilities, and use compensating controls for vulnerabilities that cannot be fixed immediately.
   • BDeploy the application to production and rely on a Web Application Firewall (WAF) to protect it from all attacks.
   • CIgnore the known vulnerabilities and focus on integrating security checks for new code only.
   • DBlock all deployments until all known vulnerabilities are fixed.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A DevSecOps team is tracking metrics for their pipeline. They have noticed that the 'time to remediate' metric is high, but the 'number of vulnerabilities in production' is low. Which of the following is the most likely explanation for this situation?

   • AThe security scans are not effective and are missing vulnerabilities that are then found in production.
   • BThe team is deploying to production without running the security scans.
   • CThe pipeline is effective at catching vulnerabilities before production, but the team is slow at fixing the ones that are found.
   • DThe pipeline is not catching many vulnerabilities, so the team has little to remediate.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A company's DevSecOps pipeline uses secrets (API keys, passwords) stored in environment variables in the CI system. The security team wants to ensure that secrets are not exposed in build logs. Which control should be implemented?

   • APrint secrets to the log only in debug mode to help troubleshooting.
   • BUse a dedicated secrets management tool and reference secrets in the pipeline without printing them to logs.
   • CStore secrets in the repository's README for easy access by developers.
   • DUse the same secret for all environments to simplify management.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company's DevSecOps pipeline uses a shared Jenkins server that also runs builds for other teams. The security team is concerned that a compromised build could affect the pipeline's integrity. Which control should be implemented to secure the pipeline itself?

   • AAllow all developers to access the Jenkins console to increase transparency.
   • BRun all builds on the master node to simplify management.
   • CDisable all security plugins to avoid configuration complexity.
   • DUse dedicated build agents for the DevSecOps pipeline and restrict access to the Jenkins server.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A software company uses Jenkins for CI/CD and has a mix of Java and Node.js applications. The security team wants to add SAST scanning to the pipeline. They are evaluating two tools: Tool X is a commercial SAST tool with a Jenkins plugin, supports both Java and Node.js, and requires a license per developer. Tool Y is an open-source SAST tool that also supports both languages and has a command-line interface but no native Jenkins plugin. The team has a limited budget and wants to minimize custom scripting. Which tool should they select?

   • ATool Y, because it can be integrated into Jenkins using a shell command in a pipeline step.
   • BTool Y, because it is open source and has no licensing cost, which is the most important factor given the limited budget.
   • CTool X, because commercial tools are always more secure than open-source tools.
   • DTool X, because the native Jenkins plugin reduces integration effort and the commercial support ensures reliable operation.
   Reveal Solution Discussion Select an answer first