Describe How to Integrate Security Sensors and Controls into DevOps Workflows. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company's CI/CD pipeline includes a SAST scan that takes 45 minutes to complete. This is slowing down the development process, and developers are complaining. The security team wants to maintain the security gate without significantly impacting developer velocity. Which strategy is the most effective to address this conflict?

   • ARemove the SAST scan from the pipeline and run it manually once a month
   • BRun the full SAST scan only on the main branch after the merge, and run a faster, incremental scan on pull requests
   • CKeep the full SAST scan in the pipeline but only run it on the deploy stage
   • DIncrease the compute resources for the pipeline to make the full scan faster
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary purpose of integrating security sensors and controls into a DevOps workflow?

   • ATo eliminate all security risks from the software
   • BTo replace the need for manual security reviews
   • CTo shift security testing to a separate, post-release phase
   • DTo ensure that security is a shared responsibility throughout the development lifecycle
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A team is using a CI/CD pipeline to build and deploy a containerized application. They want to ensure that the base images used in the build are free of known critical vulnerabilities. What is the most effective way to integrate this security sensor into the pipeline?

   • AScan the base image once a month in a separate security tool
   • BRun a vulnerability scan on the running containers in production
   • CAdd a pipeline step that scans the base image for vulnerabilities and fails the build if critical issues are found
   • DRely on the container registry's built-in scanning and review the results manually before each release
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security team wants to automatically isolate a compromised container in a Kubernetes cluster. They have a monitoring tool that detects the compromise and sends an alert to Splunk. How can they automate the response to this threat?

   • AConfigure a Splunk SOAR playbook that triggers a Kubernetes API call to isolate the pod when the alert fires
   • BHave a security analyst manually connect to the cluster and delete the pod after receiving the alert
   • CIncrease the logging level of the container to gather more information
   • DCreate a ticket for the on-call engineer to investigate the alert
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A DevOps team is deploying a web application and wants to monitor for runtime security threats. They have deployed a web application firewall (WAF) in front of the application. How can the team integrate the WAF logs into their Splunk environment to enable continuous security monitoring?

   • AStore the WAF logs in a separate database and query it only when an incident is suspected
   • BConfigure the WAF to forward logs directly to the Splunk HTTP Event Collector
   • CManually download the WAF logs from the console and upload them to Splunk at the end of each day
   • DHave the security team review the WAF logs through the vendor's cloud console
   Reveal Solution Discussion Select an answer first