Integrating Security into DevOps and the Shift-Left Approach ECDE Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A DevSecOps team has implemented continuous monitoring in production. They receive a high volume of security alerts, many of which are false positives. The team is becoming desensitized to alerts and may miss real incidents. Which strategy best improves the effectiveness of the monitoring feedback loop?

   • ADisable all alerts and rely on manual log reviews.
   • BSend all alerts to a single email distribution list.
   • CTune the alerting rules to reduce noise and prioritize alerts based on risk, and route them to the appropriate response team.
   • DIncrease the volume of alerts to ensure nothing is missed.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A team is building a REST API and wants to automatically test for common web vulnerabilities such as SQL injection and cross-site scripting. They want to run this test against a deployed instance in a staging environment. Which type of automated security testing should they integrate into the pipeline?

   • ADependency scanning
   • BContainer image scanning
   • CSAST
   • DDAST
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   An organization wants to enforce consistent security policies across multiple CI/CD pipelines. Currently, each pipeline has manually configured security steps that often drift. Which practice best addresses this using security as code?

   • AAsk each team to configure security steps independently and review them quarterly.
   • BDefine security policies and scanning steps as version-controlled templates that pipelines reference.
   • CCreate a detailed runbook that instructs engineers how to configure security steps manually.
   • DUse a shared network drive to store security scripts and copy them into each pipeline.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A team is building a microservices application with a CI/CD pipeline. They want to integrate security into the pipeline without duplicating security checks across many service pipelines. They also need to ensure that security policies are versioned and auditable. Which approach best meets these requirements?

   • ARun security checks only in a central pipeline after all services are built.
   • BCopy the same security steps into each service's pipeline manually.
   • CUse a separate security tool for each service without any shared configuration.
   • DCreate a shared security pipeline template that includes SAST, dependency scanning, and policy checks, and reference it from each service's pipeline.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A DevSecOps team has deployed an application and wants to detect security issues in real time and automatically trigger a response. Which combination of practices best enables continuous security monitoring and feedback?

   • ARunning a vulnerability scan once a month.
   • BCentralized logging and monitoring with alerting rules that trigger automated rollback or incident tickets.
   • CStoring logs in a secure bucket without any analysis.
   • DPeriodic manual log reviews by the security team.
   Reveal Solution Discussion Select an answer first