Describe How to Integrate Security Sensors and Controls into DevOps Workflows. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An organization wants to enforce a policy that all API keys and secrets are rotated every 30 days. The team uses a secrets management tool. How can this security control be automated within the DevOps workflow?

   • AAsk developers to manually update the secrets in the application configuration files
   • BConfigure the secrets management tool to automatically rotate the secrets and update the applications that use them
   • CCreate a monthly calendar reminder for the security team to rotate the secrets
   • DDisable the old secrets and require developers to create new ones when the application fails
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security team has set up a Splunk alert that triggers when a specific error signature appears in the application logs. The alert is designed to help the development team fix the underlying bug. What is the most effective way to ensure the feedback from this alert leads to remediation?

   • ALog the alert to a file and have the team check it weekly
   • BConfigure the Splunk alert to automatically create a ticket in the development team's issue tracker
   • CStore the alert in a Splunk dashboard for the team to review during the next sprint
   • DSend the alert to a shared email distribution list
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A development team is using a CI pipeline that includes a SAST tool. The tool is generating a high number of false positives, causing the team to ignore the results. What is the most effective way to improve the feedback loop so the team trusts and acts on the findings?

   • ATune the SAST tool's rules and baseline known false positives to reduce noise, and review the results with the team
   • BDisable the SAST tool in the pipeline to avoid noise
   • CSend the raw SAST output to the security team only
   • DIncrease the severity threshold so only critical issues fail the build
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A financial services firm is adopting a DevSecOps model. The security team wants to ensure that every code change is scanned for secrets and vulnerabilities before it is merged into the main branch. The team uses a Git-based workflow with pull requests. Which integration point should the security team use to enforce this requirement?

   • AA manual security review performed by the security team after merge
   • BA pipeline stage triggered on the pull request event
   • CA scheduled nightly scan of the main branch
   • DA pre-commit hook on each developer's workstation
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is a key benefit of using security feedback loops for remediation in DevOps?

   • ADevelopers can address security issues earlier in the development cycle, reducing cost and effort
   • BSecurity testing is no longer necessary after the first feedback cycle
   • CFeedback loops guarantee that no security vulnerabilities will ever occur
   • DSecurity issues are automatically resolved by the feedback system
   Reveal Solution Discussion Select an answer first