Integrating Security into DevOps and the Shift-Left Approach ECDE Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A security team currently reviews code only after the development team finishes a feature. Developers complain that security reviews are a bottleneck and that they receive feedback too late. The organization wants to embed security into the DevOps culture. Which change best addresses the cultural and collaboration challenge?

   • AAsk developers to read security documentation on their own and submit a compliance form before release.
   • BHave security engineers work as embedded members of the development teams and participate in daily stand-ups.
   • CKeep the current review process but increase the number of security reviewers to speed up the late-stage reviews.
   • DMove the security review to the end of the release cycle to avoid interfering with development.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   Which of the following is a common challenge when implementing shift-left security?

   • AThere are too many security tools available
   • BDevelopers may lack security expertise and resist adding security tasks to their workflow
   • CSecurity testing is too accurate and finds too many issues
   • DSecurity tools are too slow to run in the pipeline
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A development team is adopting a DevSecOps approach. They currently run a nightly SAST scan after the code is merged into the main branch, and developers often receive vulnerability reports days after they wrote the code. The team wants to reduce the time between code commit and vulnerability discovery. Which change best aligns with the shift-left security principle?

   • AMove the SAST scan to a post-deployment stage in the CI/CD pipeline to test the production build.
   • BReplace the SAST scan with a DAST scan performed only on the staging environment before release.
   • CRun the SAST scan as a pre-merge check in the CI pipeline on every pull request, and fail the build on critical findings.
   • DKeep the nightly scan but add a weekly manual code review by the security team to catch issues.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A development team is building a Node.js application with many third-party dependencies. They want to automatically detect known vulnerabilities in those dependencies before they reach production. Which automated security testing tool should they integrate into the CI pipeline?

   • ASAST tool that analyzes the source code for insecure coding patterns.
   • BContainer image scanner that scans the final image for OS-level vulnerabilities.
   • CDAST tool that tests the running application for runtime vulnerabilities.
   • DDependency scanning tool that checks the package-lock.json against a vulnerability database.
   Reveal Solution Discussion Select an answer first
6. 50foundation · easy

   What cultural change is essential for successfully embedding security into DevOps?

   • AEstablishing a separate security team that works independently from development and operations
   • BMaking security a separate phase at the end of the development process
   • CPromoting a culture of shared responsibility for security across all team members
   • DLimiting security knowledge to a few security specialists
   Reveal Solution Discussion Select an answer first