Integrating Security into DevOps and the Shift-Left Approach ECDE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security team wants to embed security into DevOps but faces resistance from developers who see security as a bottleneck. The developers are measured on feature delivery speed. Which approach best addresses the cultural challenge?

   • AHave the security team perform all security checks after each release.
   • BInvolve developers in security tool selection and give them ownership of security fixes in their code.
   • CSet a policy that any security issue blocks the release until the security team approves.
   • DAdd a mandatory security review meeting before every deployment.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A team is integrating security testing into a CI pipeline for a legacy application. The application has a large amount of existing code with many known vulnerabilities. The team wants to improve security without blocking all development. Which approach is most effective?

   • ARun SAST and dependency scanning on new code changes, and create a separate remediation backlog for existing vulnerabilities.
   • BBlock all builds until every existing vulnerability is fixed.
   • CDisable security scanning for the legacy application to avoid slowing down the pipeline.
   • DRun all security scans only on the release branch, not on feature branches.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A DevOps team is designing a CI/CD pipeline for a web application. They want to integrate security practices across the DevOps lifecycle. Which set of practices best covers the build, test, and deploy phases?

   • AOnly a final penetration test after deployment to production.
   • BDependency scanning only during the planning phase.
   • CSAST during build and a manual security review after deployment.
   • DSAST during build, DAST against a staging environment, and container image scanning before deployment.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A team is designing a CI/CD pipeline for a containerized application. They want to ensure that security is integrated at every phase, from code commit to production deployment. Which set of practices best covers the build, test, and deploy phases?

   • APerform all security testing in the deploy phase just before production release.
   • BScan container images for vulnerabilities in the build phase, run SAST and DAST in the test phase, and enforce deployment policies in the deploy phase.
   • CUse a single security scanner that tests everything in the build phase.
   • DRun SAST only in the build phase and skip all other security testing to save time.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A platform team wants to ensure that every new infrastructure deployment has the same security baseline, such as encrypted storage and restricted network access. They want to avoid manual configuration. Which approach best applies security as code?

   • AHave the security team review each infrastructure change after it is deployed.
   • BCreate a checklist that operators must follow when deploying infrastructure.
   • CUse a configuration management tool only for the first deployment and then rely on manual updates.
   • DDefine infrastructure as code templates that include security controls and validate them in CI/CD.
   Reveal Solution Discussion Select an answer first