Securing the DevOps Workflow GCSA Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A company has a security incident where an attacker compromised a container in a Kubernetes cluster. The container is part of a deployment that is managed by a CI/CD pipeline. The security team wants to contain the incident and prevent the attacker from moving laterally. Which action should they take first?

   • ADelete the deployment and let the CI/CD pipeline redeploy it.
   • BIsolate the compromised pod by applying a network policy that denies all traffic to and from it.
   • CScale the deployment to zero to stop all pods.
   • DTake a snapshot of the container for forensic analysis and then restart it.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company has a CI/CD pipeline that builds a container image, runs SAST and dependency scanning, and deploys to production. The security team wants to add DAST testing, but the application requires a running environment with a database and other services. The team is concerned about the time and cost of spinning up a full environment for DAST. Which approach best balances security and efficiency?

   • ASkip DAST and rely on SAST and dependency scanning to catch all vulnerabilities.
   • BDeploy the application to a temporary staging environment, run DAST against it, and tear it down after the tests complete.
   • CRun DAST only on the container image in the registry without deploying it.
   • DRun DAST against the production environment after deployment.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   During a security incident, a DevOps team discovers that a compromised CI/CD pipeline credential was used to deploy a malicious container to production. The team needs to respond quickly. Which action should be taken FIRST?

   • ANotify the security team and wait for their instructions before taking any action.
   • BReview the pipeline logs to determine the scope of the compromise.
   • CDelete the malicious container from production and redeploy the last known good version.
   • DRevoke the compromised credential and rotate all secrets that were accessible to it.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company has a CI/CD pipeline that deploys a web application. The security team wants to integrate SAST and DAST into the pipeline. They have a constraint: the DAST scan takes 30 minutes and the team wants to keep the pipeline fast. Which approach should they take?

   • ARun both SAST and DAST on every commit to ensure maximum security coverage.
   • BRun both SAST and DAST only on the main branch before deployment.
   • CRun DAST on every commit and run SAST on a schedule.
   • DRun SAST on every commit and run DAST on a schedule or on merge to the main branch.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company runs a stateful application in a cloud environment. The security team wants to adopt immutable infrastructure to improve security, but the application stores data on the local disk of the server. The team is concerned that replacing servers will cause data loss. Which approach allows them to adopt immutable infrastructure without losing data?

   • ACreate a golden image that includes the application and its data, and redeploy from that image when changes are needed.
   • BUse a snapshot of the server's disk to restore the data after a new server is deployed.
   • CMove the application's state to an external managed database or object storage and keep the compute instances stateless.
   • DUse a configuration management tool to apply changes to the running server and back up the disk before each change.
   Reveal Solution Discussion Select an answer first