Securing the DevOps Workflow GCSA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary purpose of integrating security controls into a CI/CD pipeline?

   • ATo replace the need for manual security reviews entirely
   • BTo eliminate the need for separate security testing tools
   • CTo ensure that all code changes are deployed to production without delay
   • DTo automate security checks so that vulnerabilities are detected early and consistently in the delivery process
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company builds a microservices application and packages each service as a container image. The security team wants to ensure that only approved base images are used and that the images are scanned for vulnerabilities before being pushed to the production registry. Which set of controls should be implemented in the CI pipeline?

   • AEnforce a policy that allows only images from an approved base image list, and run a vulnerability scanner on the final image before pushing it to the registry.
   • BAllow developers to use any base image but require them to manually review the image contents before pushing.
   • CPush all images to the production registry and run a scanner on a schedule to identify vulnerabilities after deployment.
   • DOnly scan the base images and assume the final image is secure if the base image is clean.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the purpose of provenance in a software supply chain?

   • ATo document the origin and history of a software artifact, including who built it and from what source
   • BTo make the artifact publicly available to all users
   • CTo automatically update the artifact when new versions are released
   • DTo compress the artifact for faster distribution
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A development team wants to integrate security checks into their CI/CD pipeline. They currently have a pipeline that builds, tests, and deploys. The security team wants to ensure that SAST and dependency scanning are performed before deployment. What is the best way to achieve this?

   • AAdd SAST and dependency scanning as stages in the pipeline that run after the build and before the deployment stage.
   • BRun SAST and dependency scanning only on the main branch after the code has been deployed.
   • CRun SAST and dependency scanning manually on a weekly basis and report the results to the development team.
   • DUse a single security tool that combines SAST and dependency scanning and run it only when a developer requests it.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company builds container images from a base image pulled from a public registry. The security team wants to ensure that only approved base images are used and that images are not tampered with after being built. Which combination of controls best addresses this?

   • ACopy base images to a shared network drive and reference them in the Dockerfile.
   • BUse a public registry and rely on the registry's built-in vulnerability scanning.
   • CPull base images directly from the public registry and scan them for vulnerabilities at runtime.
   • DUse an internal registry that only allows images built from approved base images and sign images with a private key.
   Reveal Solution Discussion Select an answer first