Securing the DevOps Workflow GCSA Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A DevOps team wants to detect and respond to security incidents in their cloud environment. They have a CI/CD pipeline that deploys applications. Which practice should they implement to ensure they can quickly identify and respond to incidents?

   • ARely on the cloud provider's default monitoring and do not integrate with any other tools.
   • BCentralize logs from all cloud services and applications into a SIEM and set up alerts for suspicious activities.
   • CEnable verbose logging for all services but do not set up any alerts to avoid alert fatigue.
   • DStore logs only in the application's local storage and review them manually when an issue is reported.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   An infrastructure team uses Terraform to manage cloud resources. They want to ensure that no resource is created with a public IP address unless explicitly allowed. Which approach should they implement in their CI/CD pipeline?

   • ARequire a manual approval step in the pipeline for any change that might create a public IP.
   • BUse a custom script that greps the Terraform configuration files for 'public_ip' and fails the build if found.
   • CConfigure the cloud provider's default network to disallow public IPs and rely on that setting.
   • DRun a policy-as-code tool, such as Open Policy Agent (OPA) or Sentinel, against the Terraform plan to deny any resource with a public IP unless it has an explicit allow tag.
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A software company distributes a binary application. The security team wants to ensure that customers can verify that the binary was built from the exact source code that the company published. The company uses a CI/CD pipeline to build the binary. Which approach provides the strongest supply chain assurance?

   • AGenerate a signed attestation in the pipeline that links the source commit hash to the built artifact and publish it.
   • BPublish the source code and the binary on the same website so customers can compare them.
   • CProvide a Dockerfile so customers can build the binary themselves.
   • DUse a checksum of the binary and publish it on the website.
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A company uses a private container registry to store images for production. The security team wants to ensure that only images that have been scanned and signed are deployed. They also want to prevent developers from accidentally using an unsigned image. Which approach should they implement?

   • AUse a policy in the container registry that requires images to be signed and scanned before they can be pulled.
   • BUse a separate registry for unsigned images and rely on the developers to use the correct one.
   • CRequire developers to manually verify the signature and scan report before using an image.
   • DUse a pre-pull validation script in the CI/CD pipeline that checks for a signature and scan report.
   Reveal Solution Discussion Select an answer first
6. 50foundation · easy

   What is the primary difference between SAST and DAST?

   • ASAST tests the application from the outside, while DAST examines the code from the inside
   • BSAST analyzes source code without executing it, while DAST tests a running application
   • CSAST is used for network security, while DAST is used for application security
   • DSAST requires a deployed environment, while DAST can run on source code
   Reveal Solution Discussion Select an answer first