Securing the DevOps Workflow GCSA Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary purpose of centralized logging in a DevOps environment?

   • ATo aggregate logs from multiple sources into a single location for analysis and correlation
   • BTo store logs in a format that is only readable by the application developers
   • CTo reduce the amount of log data generated by applications
   • DTo automatically delete logs after a short retention period to save costs
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A large organization has separate CI/CD pipelines for different business units. The security team wants to enforce a consistent set of security checks (SAST, dependency scanning, and policy-as-code) across all pipelines without requiring each team to configure the checks manually. The teams have different build tools and languages. Which approach best meets the requirement?

   • ACreate a shared pipeline template that includes the required security checks and require all teams to use it.
   • BUse a single centralized pipeline for all teams, replacing their existing pipelines.
   • CProvide a documented checklist of security checks and ask each team to add them to their pipelines.
   • DRun security checks only on the final artifacts after all pipelines have deployed to production.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the purpose of dependency scanning in a DevOps pipeline?

   • ATo test the application's user interface for usability issues
   • BTo measure the performance of the application under load
   • CTo ensure that all dependencies are licensed for commercial use
   • DTo identify known vulnerabilities in third-party libraries and packages used by the application
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company deploys a web application to a cloud environment. Currently, when a configuration change is needed, an administrator logs into the running server and edits files directly. The company wants to adopt immutable infrastructure to reduce configuration drift and improve security. Which practice best achieves this?

   • ADefine the server configuration in a versioned template and redeploy a new server from that template for every change.
   • BCreate a golden image and manually patch it each time a change is needed, then reuse it for new servers.
   • CAllow administrators to edit files directly but log all changes for audit purposes.
   • DUse a configuration management tool to apply changes to the running server automatically on a schedule.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   An organization uses Terraform to manage infrastructure across multiple AWS accounts. They want to enforce a policy that prohibits the creation of S3 buckets with public read access. The policy must be enforced before any resource is created. Which approach is the most effective?

   • AUse AWS Service Control Policies (SCPs) to deny the s3:PutBucketAcl and s3:PutBucketPolicy actions.
   • BUse a custom script that searches the Terraform code for 'acl = "public-read"' and fails the build if found.
   • CRequire a manual approval from the security team for any change that creates an S3 bucket.
   • DUse a policy-as-code tool like OPA to evaluate the Terraform plan and deny any bucket with a public ACL or policy.
   Reveal Solution Discussion Select an answer first