Implement and Integrate Security Solutions ISSEP Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company's CI/CD pipeline deploys containerized applications to a Kubernetes cluster. The security team wants to ensure that only signed and trusted container images are deployed. Which of the following is the most effective control to implement?

   • AConfigure the Kubernetes cluster to enforce image signature verification using a policy engine.
   • BAdd a manual approval step in the pipeline for every image deployment.
   • CScan the container images for vulnerabilities after they are deployed.
   • DStore all container images in a private registry and restrict access.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A system administrator is responsible for maintaining the security configuration of a fleet of Linux servers. The organization has a security baseline that must be applied to all servers. Which of the following is the most effective way to ensure the servers remain compliant with the baseline?

   • AUse a configuration management tool to enforce the baseline and report on drift.
   • BManually apply the baseline to each server during initial setup and then rely on periodic audits.
   • CCreate a script that applies the baseline and run it once a year.
   • DDocument the baseline in a wiki and ask administrators to follow it.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security engineer has implemented a new intrusion detection system (IDS) in the network. The IDS is generating a high number of alerts, many of which are false positives. The engineer needs to validate that the IDS is correctly detecting real threats without overwhelming the security team. Which of the following is the most appropriate action?

   • ADisable the IDS until the false positives are resolved.
   • BTune the IDS rules and thresholds based on the observed false positives and test with known attack patterns.
   • CIncrease the sensitivity of the IDS to catch more potential threats.
   • DIgnore the false positives and focus on the alerts that seem legitimate.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which practice reflects the DevSecOps approach to security?

   • AConducting a security review only after the application is deployed
   • BUsing a separate, isolated security toolchain
   • CInvolving security teams early in the design and development process
   • DKeeping security requirements confidential from developers
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A software company is adopting DevSecOps and wants to integrate security scanning into its CI/CD pipeline. The pipeline currently builds, tests, and deploys a web application. Which of the following is the most effective way to incorporate security without slowing down the pipeline?

   • ARequire a security review by the security team for every code commit.
   • BAdd a dynamic application security test (DAST) stage that runs after deployment to production.
   • CPerform a manual penetration test before every production release.
   • DRun a static application security test (SAST) as a parallel stage after the build step.
   Reveal Solution Discussion Select an answer first