Describe How to Integrate Security Sensors and Controls into DevOps Workflows. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   How are security controls automated in DevOps workflows to enforce policies?

   • ABy using a separate, disconnected security tool that runs after deployment
   • BBy documenting policies in a wiki and expecting developers to follow them
   • CBy embedding policy-as-code checks that run automatically during the pipeline
   • DBy relying on security teams to manually review each deployment
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company has implemented a DAST tool that runs against a staging environment. The tool is generating a large number of alerts, and the development team is overwhelmed. The security team wants to prioritize the alerts so the developers can focus on the most critical issues first. What is the most effective way to prioritize the DAST findings?

   • APrioritize alerts based solely on the CVSS score of the vulnerability
   • BPrioritize alerts by the number of times the vulnerability appears in the scan report
   • CPrioritize alerts based on the order they were detected by the scanner
   • DPrioritize alerts by correlating the DAST findings with Splunk data on exposed assets, business criticality, and active threats
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A large enterprise is implementing a DevSecOps strategy. They have a mix of legacy applications that are deployed manually and new cloud-native applications that use a full CI/CD pipeline. The security team has limited resources and cannot manually review every change. They need to enforce a policy that no critical vulnerabilities are present in production. Which approach best balances the need for security enforcement with the reality of the mixed environment?

   • AFocus all security efforts on the new cloud-native applications and accept the risk for legacy applications
   • BImplement automated security scanning in the CI/CD pipeline for new applications and use compensating controls for legacy applications
   • CRequire all legacy applications to be migrated to the CI/CD pipeline before any security controls are implemented
   • DApply the same automated pipeline scanning to legacy applications by manually triggering the pipeline for each release
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A DevOps team wants to automatically block a deployment if a critical vulnerability is found in the application's dependencies. The team uses a CI/CD pipeline with separate build, test, and deploy stages. What is the most appropriate way to automate this security control?

   • ASend an email alert to the security team after the deployment is complete
   • BCreate a ticket in the IT service management system for the development team to review
   • CConfigure the deploy stage to check a static report that is manually updated by the security team
   • DAdd a security scanning stage before the deploy stage that fails the pipeline if a critical vulnerability is detected
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company is moving from a waterfall to a DevOps model. The security team wants to ensure that security is considered throughout the development lifecycle, not just at the end. Which approach best reflects this shift?

   • ACreating a separate security phase in the project plan after the testing phase
   • BEmbedding security tools and practices into the CI/CD pipeline stages from code commit to deployment
   • CPerforming a single, comprehensive security review just before the production release
   • DHaving the security team audit the codebase manually at the end of each sprint
   Reveal Solution Discussion Select an answer first