Define Secure Operational Architecture (e.g., Deployment Topology, Operational Interfaces, Continuous Integration and Continuous Delivery (CI/CD)) CSSLP Practice Questions (Page 5)

Questions 21–24

1. 21application · medium

   An organization is deploying a new web application in a multi-tier architecture. The security architect must ensure that the configuration of each tier is consistent and that unauthorized changes are detected. Which secure configuration management practice should be implemented?

   • AManually configure each server after deployment, and document the changes in a shared spreadsheet.
   • BCreate a golden image for each tier, but do not update it after initial deployment to avoid configuration drift.
   • CUse infrastructure-as-code templates to define the configuration of all tiers, and store them in a version-controlled repository with peer review.
   • DUse a configuration management tool to apply settings, but allow administrators to make ad-hoc changes directly on the servers when needed.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Why is it important to scan container images for vulnerabilities before deploying them through a CI/CD pipeline?

   • ATo ensure the image is small enough for fast deployment
   • BTo verify that the image was built from the latest source code
   • CTo check that the image is compatible with the orchestration platform
   • DTo identify known vulnerabilities in the base image and dependencies
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security operations center (SOC) needs to detect and respond to attacks against a new microservices-based application. The application uses multiple APIs and management ports. Which monitoring and logging strategy should the security architect recommend?

   • ALog only security-related events (e.g., login failures) and store them locally on each service instance for privacy.
   • BEnable verbose logging on all services, store logs in a centralized SIEM, and alert on anomalies such as failed authentication and unusual API call patterns.
   • CDisable logging on management ports to reduce noise, and enable logging only on the public-facing API gateway.
   • DUse a third-party monitoring service that only tracks performance metrics, and rely on manual log review by developers.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A software company is implementing a CI/CD pipeline for a web application. The security architect wants to ensure that only approved and securely configured code is deployed to production. Which practice should be included in the pipeline?

   • ARequire a manual approval step before production deployment, and automatically verify that the build matches a signed artifact from the CI server.
   • BUse a configuration management tool to push the latest code to production servers, but do not track which version is deployed.
   • CAutomatically deploy every successful build to production without any manual review to speed up releases.
   • DAllow developers to deploy directly from their local machines to production if they have the correct credentials.
   Reveal Solution Discussion Select an answer first