Integrating Security into DevOps and the Shift-Left Approach ECDE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   In a CI/CD pipeline, when is dynamic application security testing (DAST) typically performed?

   • AOnly in production, as a final check
   • BDuring code review, before the code is committed
   • CDuring the build stage, before the application is compiled
   • DAfter the application is deployed to a test or staging environment
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A company is adopting DevSecOps and has assigned all security responsibilities to a central security team. Developers are told to continue focusing only on features, and the security team will review code after each sprint. Which change is most important to successfully embed security into the DevOps lifecycle?

   • AKeep the current separation but add a security sign-off before each release.
   • BHave the security team write all security tests and run them manually after each sprint.
   • CEstablish a shared responsibility model where developers, operations, and security jointly own security outcomes.
   • DMove all security testing to a dedicated pre-production environment managed by the security team.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   How does security as code enable repeatable security controls in CI/CD pipelines?

   • ABy storing security policies in a shared document that teams read before each release
   • BBy requiring manual approval from a security officer for each deployment
   • CBy embedding security checks as automated steps that run consistently on every build
   • DBy using a different security tool for each pipeline run
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   How do feedback loops from continuous security monitoring contribute to DevSecOps?

   • ABy eliminating the need for security training for developers
   • BBy providing information that helps teams improve security practices and respond to incidents faster
   • CBy automatically fixing all security issues without any human review
   • DBy ensuring that security testing is performed only once per release
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which automated security testing tool is designed to identify vulnerabilities by analyzing source code without executing the application?

   • ADependency scanning
   • BRuntime application self-protection (RASP)
   • CDynamic Application Security Testing (DAST)
   • DStatic Application Security Testing (SAST)
   Reveal Solution Discussion Select an answer first