5.2 Explain Rule and Policy Deployment and Management CLOUD-SECURITY-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company has multiple development teams using different CI/CD pipelines. They want to enforce a common security policy that all code must pass a security scan before deployment. However, some teams use Jenkins, while others use GitLab CI. The security team wants to manage the policy centrally. What is the most effective approach?

   • AUse a single centralized CI/CD pipeline for all teams to enforce the policy.
   • BRequire each team to manually run a security scan before deployment and submit a report.
   • CConduct a security review after deployment and roll back if issues are found.
   • DDefine the security policy as code and integrate it into each pipeline using a shared library or plugin.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A development team uses a CI/CD pipeline to deploy a containerized web application. During a recent security review, the team discovered that a known critical vulnerability in a third-party library was present in the production image. The vulnerability had been flagged by a scanner but did not block the deployment because the pipeline only ran the scanner on the source code, not on the final container image. The team wants to prevent this from happening again. Which action should be taken?

   • ARequire developers to manually review the source code for known vulnerabilities before merging pull requests.
   • BMove the scanner to run only on a nightly schedule against the latest source code, and email the results to the security team.
   • CDisable the scanner in the pipeline and rely on the cloud provider's built-in security monitoring to alert on production vulnerabilities.
   • DAdd a container image scanning step to the pipeline that fails the build if critical or high vulnerabilities are found in the image.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company wants to enforce a policy that all code deployed to production must pass a security scan. They have multiple teams using different CI/CD tools. What is the most effective way to enforce this policy consistently?

   • ADefine a common security policy as code and integrate it into each team's CI/CD pipeline.
   • BUse a single centralized CI/CD pipeline for all teams to enforce the policy.
   • CConduct a security review after deployment and roll back if issues are found.
   • DRequire each team to manually run a security scan before deployment and submit a report.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An organization's security team uses an AI-based tool that monitors application behavior and suggests security guardrails. The tool recommends a guardrail that would block all outbound traffic to a specific geographic region. The team is concerned about the impact on legitimate business operations. What is the best way to proceed?

   • AReview the recommendation, assess the business impact, and test the guardrail in a non-production environment before deploying.
   • BReject the recommendation because it is too broad and could affect business operations.
   • CAsk the AI tool to provide a more specific recommendation that only blocks traffic to known malicious IPs.
   • DDeploy the guardrail immediately to all environments to block the traffic as soon as possible.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company has a policy that all code must pass a security scan before being deployed to production. They use a CI/CD pipeline that includes a security scanning step. A developer needs to deploy a hotfix for a critical bug, but the security scan is failing due to a low-severity vulnerability that is not related to the hotfix. What should the developer do?

   • AFix the low-severity vulnerability before deploying the hotfix.
   • BRequest an exception from the security team to bypass the scan for this deployment.
   • CDisable the security scan for this build and deploy the hotfix.
   • DDeploy the hotfix and address the vulnerability later.
   Reveal Solution Discussion Select an answer first