What is the purpose of verifying artifact integrity in a software supply chain?

To ensure that artifacts are free of all known vulnerabilities

To ensure that software artifacts have not been tampered with or altered during the build or distribution process

To ensure that artifacts are stored in a public repository

To ensure that artifacts are compatible with all operating systems

A company uses a CI/CD pipeline to build a container image from a base image and application code. The security team wants to ensure that the base image is from a trusted source and has not been tampered with. Which practice should they implement?

Use a base image from a public registry and rely on the registry's reputation.

Use a base image that is pinned to a specific tag and assume it is safe.

Use a base image that is stored in a private registry and assume it is secure.

Use a signed base image from a trusted registry and verify the signature in the CI/CD pipeline before building.

What is the main goal of policy-as-code?

To define and enforce security and compliance policies programmatically, often integrated into CI/CD pipelines

To write security policies in natural language for easier understanding

To store security policies in a database for manual retrieval

To replace all manual security reviews with automated code generation

A company has a CI/CD pipeline that deploys a web application. The application needs to connect to a database. The security team wants to ensure that database credentials are not exposed to developers and are rotated automatically. They also want to minimize the impact if a credential is compromised. Which solution should they implement?

Use a single set of credentials for all environments and rotate them when a developer leaves the company.

Store the credentials in the pipeline's environment variables and rotate them manually every month.

Embed the credentials in the application's configuration file and restrict access to the repository.

Use a secrets vault to store the credentials and have the application retrieve them at runtime using short-lived tokens.

What is the primary purpose of using a secrets management vault (e.g., HashiCorp Vault) in a DevOps environment?

To automatically scan source code for hardcoded secrets

To encrypt all data stored in cloud databases

To centrally store and control access to sensitive credentials such as API keys and passwords

To replace the need for identity and access management (IAM) policies

GIAC Cloud Security Automation

Domain 1Objective 2

Securing the DevOps Workflow GCSA Practice Questions (Page 6)

Part of the DevOps and Cloud Infrastructure domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–19 in this domain), expect 3–5 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

10concepts

Questions 26–30

26foundation · easy
What is the purpose of verifying artifact integrity in a software supply chain?
Select an answer first
27expert · hard
A company uses a CI/CD pipeline to build a container image from a base image and application code. The security team wants to ensure that the base image is from a trusted source and has not been tampered with. Which practice should they implement?
Select an answer first
28foundation · easy
What is the main goal of policy-as-code?
Select an answer first
29expert · hard
A company has a CI/CD pipeline that deploys a web application. The application needs to connect to a database. The security team wants to ensure that database credentials are not exposed to developers and are rotated automatically. They also want to minimize the impact if a credential is compromised. Which solution should they implement?
Select an answer first
30foundation · easy
What is the primary purpose of using a secrets management vault (e.g., HashiCorp Vault) in a DevOps environment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.