A DevOps team is integrating SBOM generation into their CI/CD pipeline. They use multiple programming languages and build tools. They need to ensure that SBOMs are generated consistently for all components and are available for every release. Which approach is most robust?

Use a single SBOM generation tool that claims to support all languages.

Use a standardized SBOM format (e.g., SPDX or CycloneDX) and generate SBOMs using language-specific plugins in each build step, then aggregate them.

Generate SBOMs manually for each release to ensure accuracy.

Generate an SBOM only for the final deployable artifact, ignoring intermediate components.

A company must provide a list of all open-source components used in a product to a customer. The product is built from multiple microservices, each with its own dependencies. Which approach ensures the SBOM is complete and accurate?

Generate an SBOM only for the main application and assume microservices share the same dependencies.

Generate an SBOM for each microservice and aggregate them into a single product-level SBOM.

Use a single SBOM generated from the root of the repository, including all code.

Create an SBOM manually by listing all libraries from memory.

What is a common method for generating an SBOM?

Asking each developer to report the libraries they used

Extracting data from the software's user documentation

Using automated tools that scan the software build process to inventory components

Manually listing all components in a spreadsheet

How do SBOMs integrate into DevOps pipelines?

They are stored in the source code repository as comments

They are generated automatically during the build stage and stored as artifacts

They are only generated when a security audit is requested

They are created manually after each release by the operations team

A security audit requires the DevOps team to prove that the exact code deployed to production matches the code that was reviewed and approved. Which DevOps practice, combined with SBOMs, best supports this compliance requirement?

Perform a manual code review before each deployment.

Store the source code in a version control system and assume that is sufficient.

Rely on the SBOM alone, since it lists all dependencies and versions.

Use immutable build artifacts with a unique hash and record the hash in the deployment pipeline.

Certified Tester Quality in DevOps

Domain 4Objective 4

Observability and Compliance CT-QDO Practice Questions (Page 4)

Part of the Domain 4: Tools and Practices in DevOps domain, which makes up ~19% of our current practice bank. ISTQB does not publish an official question count, but from its 60-minute exam (~25–40 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

7concepts

Questions 16–20

16expert · hard
A DevOps team is integrating SBOM generation into their CI/CD pipeline. They use multiple programming languages and build tools. They need to ensure that SBOMs are generated consistently for all components and are available for every release. Which approach is most robust?
Select an answer first
17application · medium
A company must provide a list of all open-source components used in a product to a customer. The product is built from multiple microservices, each with its own dependencies. Which approach ensures the SBOM is complete and accurate?
Select an answer first
18foundation · easy
What is a common method for generating an SBOM?
Select an answer first
19foundation · easy
How do SBOMs integrate into DevOps pipelines?
Select an answer first
20application · medium
A security audit requires the DevOps team to prove that the exact code deployed to production matches the code that was reviewed and approved. Which DevOps practice, combined with SBOMs, best supports this compliance requirement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-QDO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-QDO” is a trademark of its owner, used for identification only.