Integrating Security into DevOps and the Shift-Left Approach ECDE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A DevSecOps team wants to detect security issues that only appear under production load, such as race conditions or resource exhaustion. They already run SAST and DAST in staging. What should they add to improve detection?

   • AA manual code review focused on concurrency issues.
   • BMore frequent SAST scans in the CI pipeline.
   • CRun DAST once more in staging with a larger dataset.
   • DContinuous monitoring of production metrics and logs with automated alerting.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A platform team wants to enforce consistent security policies across multiple microservices. They plan to define security controls as code and integrate them into the CI/CD pipeline. Which approach best exemplifies security as code?

   • ACreate a shared network drive with security scripts that teams can run if they remember to.
   • BStore security policies in a Git repository and use a policy-as-code tool to evaluate infrastructure and application configurations in the pipeline.
   • CDocument security policies in a wiki and have each team manually apply them during deployment.
   • DUse a security consultant to review each microservice's configuration before release.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which of the following is a key benefit of shifting security left in the DevOps lifecycle?

   • AIncreases the cost of fixing vulnerabilities because they are found earlier
   • BEliminates the need for any security testing after deployment
   • CEnsures that all security vulnerabilities are completely eliminated before release
   • DReduces the cost and effort required to remediate vulnerabilities
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A large enterprise is adopting shift-left security. The security team wants to enforce a comprehensive set of security gates, but developers are resisting because the pipeline has become slow and they feel the security team is imposing rules without understanding the development context. The team wants to balance security with developer productivity. Which approach best addresses this challenge?

   • AHave the security team manually review all findings before they are shown to developers.
   • BRemove all security gates to speed up the pipeline.
   • CCollaborate with developers to define a risk-based policy that prioritizes critical findings and allows developers to provide feedback on the security tools.
   • DEnforce all security gates immediately to ensure maximum security.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A team is deploying a critical application and wants to ensure that security is integrated from planning through operations. They have already added SAST and DAST to the pipeline. What additional practice should they implement to cover the operations phase?

   • ARun SAST again after deployment to catch any new issues.
   • BDisable monitoring to reduce operational overhead.
   • CConduct a security review of the code before each release and then stop.
   • DSet up automated monitoring and alerting for security events in production, with a defined incident response process.
   Reveal Solution Discussion Select an answer first