Integrating Security into DevOps and the Shift-Left Approach ECDE Practice Questions (Page 11)

Questions 51–55

1. 51expert · hard

   A platform team is building a self-service CI/CD platform for multiple product teams. Each team has different compliance requirements. The team wants to ensure that security controls are consistent but also allow teams to customize their pipelines. Which approach best achieves both goals using security as code?

   • AProvide a library of versioned, reusable security policy modules that teams can include in their pipelines, with mandatory defaults enforced centrally.
   • BCreate a single, fixed pipeline template that all teams must use without modification.
   • CUse a central security team to manually approve every pipeline change.
   • DAllow each team to define their own security policies from scratch.
   Reveal Solution Discussion Select an answer first
2. 52expert · hard

   A company wants to implement security as code for their cloud infrastructure. They use Terraform to provision resources. They need to ensure that any security policy change is reviewed and tested before it affects production. Which approach best aligns with security as code principles?

   • AStore policies in a shared document and have engineers manually apply them.
   • BUse a separate, unversioned policy file that is only accessible to the security team.
   • CStore Terraform policies in a Git repository, use pull requests for changes, and run policy tests in the CI pipeline before applying to production.
   • DApply policy changes directly to production using the Terraform CLI.
   Reveal Solution Discussion Select an answer first
4. 53application · medium

   A DevSecOps team has deployed a new version of an application. They want to ensure that security issues are detected quickly in production and that the development team receives actionable feedback. Which practice best supports continuous security monitoring and feedback loops?

   • ACollect security logs and metrics from production, and automatically create work items for the development team when anomalies are detected.
   • BRun a full security audit once a month and email the report to the security team only.
   • CDisable monitoring in production to avoid false alarms and rely on pre-release testing.
   • DStore all security logs in a central repository and require developers to manually check them daily.
   Reveal Solution Discussion Select an answer first
5. 54application · medium

   A DevSecOps team is introducing security testing into a new microservices project. The team wants to catch vulnerabilities before code is merged, but developers complain that running a full DAST scan on every commit is too slow. Which approach best aligns with shift-left principles while keeping the pipeline fast?

   • ARun SAST and dependency scanning on every pull request, and schedule DAST scans nightly against a staging environment.
   • BRun DAST on every commit and defer SAST until the release candidate is built.
   • CRun SAST on every commit and skip dependency scanning because it is not a code-level check.
   • DRun all security scans only once, just before production deployment, to avoid slowing down development.
   Reveal Solution Discussion Select an answer first
6. 55application · medium

   A company is deciding whether to invest in shift-left security. The security team argues that fixing vulnerabilities early is cheaper, but management wants evidence. Which metric best demonstrates the cost benefit of shift-left security?

   • ATotal number of vulnerabilities discovered in the last year.
   • BNumber of security tools deployed in the CI/CD pipeline.
   • CPercentage of developers who completed security training.
   • DAverage time to remediate a vulnerability found in the development phase versus one found in production.
   Reveal Solution Discussion Select an answer first