Integrating Security into DevOps and the Shift-Left Approach ECDE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A team is building a CI/CD pipeline for a web application. They want to catch common coding flaws early, but they also need to verify that the running application does not expose sensitive data through its HTTP responses. Which combination of automated tests should be added to the pipeline?

   • ADAST in the build stage and SAST against the production environment.
   • BSAST in the build stage and DAST against a deployed staging environment.
   • COnly DAST, because it covers both source code and runtime issues.
   • DOnly SAST, because it can detect all runtime vulnerabilities.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   In which DevOps phase would threat modeling typically be performed as a security practice?

   • APlanning
   • BMonitoring
   • CDeployment
   • DOperations
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which best practice helps overcome the challenge of developers lacking security expertise in a shift-left approach?

   • AHiring a large security team to review every line of code
   • BProviding security training and embedding security champions within development teams
   • CRemoving all security testing from the pipeline to speed up releases
   • DRequiring developers to become full-time security experts
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company is deciding between two security testing strategies: (1) running SAST on every commit and DAST on every release candidate, or (2) running only DAST on production after deployment. The company has a tight release schedule and limited security tooling budget. Which consideration is most important when choosing the shift-left strategy?

   • AThe need to avoid any additional pipeline time, regardless of security benefits.
   • BThe potential cost savings from fixing vulnerabilities earlier, which often outweigh the increased tooling and pipeline time.
   • CThe fact that SAST is always faster than DAST, so it should always be preferred.
   • DThe requirement to use only open-source security tools.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the core principle of shift-left security in a DevSecOps context?

   • APerforming security testing only after the application is deployed to production
   • BFocusing security efforts on the operations phase only
   • CIntegrating security activities and testing as early as possible in the software development lifecycle
   • DUsing a separate security team to handle all security tasks after each release
   Reveal Solution Discussion Select an answer first