Securing the DevOps Workflow GCSA Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A company has a microservices architecture with hundreds of services. The security team wants to detect a potential attacker moving laterally between services. They have centralized logging but are overwhelmed by the volume of logs and alerts. Which approach improves detection without increasing alert fatigue?

   • AStore all logs in a central repository and only review them during an incident.
   • BImplement a baseline of normal network traffic between services and alert only on deviations from that baseline.
   • CUse a simple rule that alerts whenever any service communicates with any other service.
   • DAlert on every failed login attempt across all services.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Why is it important to have incident response procedures tailored to DevOps and cloud environments?

   • ABecause cloud environments do not require logging or monitoring
   • BBecause traditional incident response procedures are always ineffective
   • CBecause cloud and DevOps environments have unique characteristics such as ephemeral resources and infrastructure-as-code that affect how incidents are handled
   • DBecause incident response is only necessary in cloud environments
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A security incident is detected in a DevOps environment: an attacker compromised a CI/CD pipeline and injected malicious code into a production application. The team has a runbook for incident response. The runbook says to isolate the affected systems, but the application is critical and cannot be taken offline. Which action best balances containment and business continuity?

   • ATake the application offline immediately to prevent further damage.
   • BDisconnect the entire production network to isolate the application.
   • CLeave the application running and investigate the incident without taking any action.
   • DRevoke the compromised pipeline credentials, roll back the application to the last known good version, and increase monitoring.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A company uses a container registry that automatically scans images for vulnerabilities. The security team wants to ensure that only images that pass the scan are deployed to production. However, the team also wants to allow developers to use images that have known vulnerabilities in development environments for testing. Which approach best satisfies both requirements?

   • AAllow all images to be deployed and rely on runtime monitoring to detect exploitation.
   • BConfigure the registry to block deployment of images with critical vulnerabilities in production, but allow them in development.
   • CUse separate registries for development and production, with scanning only on the production registry.
   • DBlock all images with any vulnerability from being deployed to any environment.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company experiences a security incident where an attacker gains access to a production server. The server was deployed using immutable infrastructure. What is the most effective first step in the incident response process?

   • ATake a snapshot of the server for forensic analysis and then restore it from a backup.
   • BAttempt to patch the compromised server in place and continue monitoring it.
   • CIsolate the compromised server and replace it with a new instance from the golden image.
   • DShut down the server and wait for the security team to investigate it manually.
   Reveal Solution Discussion Select an answer first