Release Software Securely CSSLP Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A team is designing a CI/CD pipeline for a web application. The pipeline currently runs unit tests and builds a container image. The team wants to add security checks without significantly slowing down the pipeline. Which set of checks should be added?

   • ARun SAST on the source code and SCA on dependencies in parallel during the build stage.
   • BRun a penetration test against the production environment after each release.
   • CRun a full DAST scan on every commit before merging.
   • DPerform a manual code review for security issues on every commit.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company has a CI/CD pipeline that produces signed build artifacts. The security team wants to ensure that only artifacts built by the official pipeline are deployed to production. Which control should be implemented?

   • AEnsure the artifact is stored in a secure repository with access controls.
   • BCompare the artifact's file size to the size of the previous release.
   • CCheck that the artifact's version number matches the version in the release notes.
   • DVerify the artifact's digital signature using the pipeline's public key before deployment.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is a core principle of DevSecOps?

   • ASecurity is achieved by using automated tools exclusively, without human involvement
   • BSecurity is applied only at the end of the lifecycle to avoid slowing down development
   • CSecurity is the sole responsibility of the security team
   • DSecurity is integrated throughout the development and deployment lifecycle, with shared responsibility across all teams
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following best describes how automated security scanning is integrated into a CI/CD pipeline?

   • ASecurity scanning is only run on the production environment after deployment
   • BSecurity scanning is replaced by manual code reviews before deployment
   • CSecurity tools are run as part of the pipeline stages, with results evaluated to decide whether the build proceeds
   • DSecurity scanning is performed only during the final release phase
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company is adopting DevSecOps practices. The development team is responsible for writing code, and the security team is responsible for security testing. The company wants to foster shared responsibility. Which action best supports this goal?

   • AKeep security testing solely within the security team to maintain a separation of duties.
   • BHave the security team fix all security issues found in the code.
   • CRequire developers to pass a security certification before they can commit code.
   • DProvide security training to developers and give them access to the security scanning tools and results.
   Reveal Solution Discussion Select an answer first