Describe How to Integrate Security Sensors and Controls into DevOps Workflows. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A software company is deploying a new microservice to a Kubernetes cluster. The security team wants to ensure that the container image is scanned for vulnerabilities at the time it is built, and that the results are automatically sent to Splunk for analysis. The team uses a Jenkins pipeline for builds. What is the most effective way to configure this?

   • AAdd a build stage in Jenkins that runs the container scanner and uses the Splunk HTTP Event Collector to forward the results
   • BInstall a container scanner on each developer's machine and have them report results manually
   • CUse a cron job inside the running container to scan its own filesystem and log to stdout
   • DConfigure a Kubernetes admission controller to scan images after they are deployed
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   In a DevOps workflow, at which stage are security sensors and controls typically integrated to provide early feedback to developers?

   • ADuring the post-production monitoring phase only
   • BOnly during the deployment stage
   • CAt every stage from code commit to deployment and operations
   • DOnly during the requirements gathering phase
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   In a CI/CD pipeline, how are security sensors typically deployed to provide continuous monitoring?

   • AAs automated tools or agents that run within pipeline stages and report findings
   • BAs external services that only analyze the final production environment
   • CAs static documents that list security best practices for developers to follow
   • DAs manual checkpoints that require human approval before each stage
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security operations team has integrated a SAST tool into the CI pipeline. The tool generates a JSON report of findings. The team wants to use this data to automatically create work items for the development team to fix the issues. What is the most effective way to close this feedback loop?

   • AEmail the JSON report to the entire development team
   • BConfigure the pipeline to parse the JSON report and use the project management tool's API to create work items
   • CSend the JSON report to a shared network drive for developers to review
   • DHave the security team manually copy the findings from the JSON report into the work item tracker
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is a common configuration practice for security sensors in a CI/CD pipeline to ensure they do not slow down the development process?

   • AConfiguring sensors to run in parallel and only on changed code where possible
   • BUsing only manual security testing to avoid pipeline complexity
   • CRunning all scans sequentially on the full codebase after every commit
   • DDisabling sensors during peak development hours to save resources
   Reveal Solution Discussion Select an answer first