Integrating Security into DevOps and the Shift-Left Approach ECDE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which security practice is most directly associated with the 'Code' phase of the DevOps lifecycle?

   • AConfiguring a web application firewall
   • BRunning penetration tests against the production environment
   • CPerforming static application security testing (SAST)
   • DConducting a post-incident review
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A team is developing a new feature. They want to identify security requirements early, before any code is written. Which activity best exemplifies shift-left security in the planning phase?

   • AReviewing the code after the feature is merged into the main branch.
   • BPerforming a penetration test on the production environment after release.
   • CRunning a DAST scan on the staging environment after the feature is implemented.
   • DConducting a threat modeling session to identify potential threats and define security acceptance criteria for the feature.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A startup is building a new application and has a small team. They are deciding whether to invest in shift-left security tooling now or wait until after the first release. The team is concerned about time-to-market. Which consideration best justifies investing in shift-left security now?

   • AThe team should wait until they have more developers to implement security.
   • BIt is always cheaper to add security after the first release because the codebase is smaller.
   • CShift-left security guarantees a faster release because it eliminates all security issues.
   • DEarly detection reduces the cost of fixing vulnerabilities, and the tooling can be integrated incrementally without significantly delaying the release.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A development team is adding automated security testing to their CI pipeline. They want to catch vulnerabilities in third-party libraries as early as possible. Which type of scan should be integrated into the pipeline?

   • AContainer image scanning that checks the base image for vulnerabilities.
   • BDAST that tests the running application for runtime vulnerabilities.
   • CSAST that analyzes the application's source code for coding flaws.
   • DDependency scanning that checks for known vulnerabilities in open-source packages.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   How does shift-left security contribute to an improved security posture?

   • ABy reducing the number of security tools used in the pipeline
   • BBy ensuring that security testing is performed only by external auditors
   • CBy shifting all security responsibilities to the operations team
   • DBy allowing security issues to be identified and addressed earlier in the development process
   Reveal Solution Discussion Select an answer first