Observability and Compliance CT-QDO Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company must provide an SBOM for a product that includes both proprietary code and third-party components. The legal team requires that the SBOM be accurate but also wants to avoid exposing proprietary code details. Which approach is most appropriate?

   • AGenerate a full SBOM that includes all proprietary modules and their internal names.
   • BGenerate an SBOM only for the proprietary code, omitting third-party components.
   • CDo not generate an SBOM to avoid any risk of exposure.
   • DGenerate an SBOM that lists only third-party components and their versions, without including proprietary module details.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What role do SBOMs play in ensuring compliance in DevOps?

   • AThey replace the need for security testing
   • BThey are only useful for internal teams, not for external auditors
   • CThey automatically enforce all compliance policies
   • DThey provide evidence of the components used, supporting license and regulatory compliance
   Reveal Solution Discussion Select an answer first
4. 13application · easy

   A DevOps team is designing a monitoring solution for a new application. They want to ensure that when a user reports a problem, they can see the exact sequence of events leading up to the issue. Which observability pillar is most directly responsible for providing this chronological view?

   • ATraces, because they show the path of a request through services.
   • BLogs, because they record discrete events with timestamps in the order they occurred.
   • CDashboards, because they visualize all data in one place.
   • DMetrics, because they show numerical values over time.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   How are SBOMs used in vulnerability management?

   • ABy preventing any new vulnerabilities from being introduced
   • BBy identifying which components are affected by known vulnerabilities
   • CBy encrypting all communication between components
   • DBy automatically patching all vulnerabilities in the software
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A DevOps team wants to automate the generation of SBOMs for every build and store them as artifacts. Their goal is to quickly identify which deployed version of an application contains a specific vulnerable library. Which practice best supports this goal?

   • AStore SBOMs in a separate database without linking them to build artifacts.
   • BUse a manual process to create SBOMs after each release.
   • CGenerate an SBOM only when a vulnerability is reported, to save pipeline time.
   • DGenerate an SBOM in the CI pipeline and attach it to the build artifact, then store it with the release metadata.
   Reveal Solution Discussion Select an answer first