CDM Continuous Integration & Continuous Delivery 4 — Questions and Answers
Question 1: Which tool category is used in CI pipelines to detect known security vulnerabilities in third-party dependencies?
- Static Application Security Testing (SAST)
- Software Composition Analysis (SCA) (Correct answer)
- Dynamic Application Security Testing (DAST)
- Interactive Application Security Testing (IAST)
Correct answer: Software Composition Analysis (SCA)
Software Composition Analysis (SCA) tools scan dependency manifests and lock files to identify known CVEs in open-source libraries used by the application.
Question 2: What problem does a 'deployment pipeline' solve compared to a traditional release process?
- It eliminates the need for version control by automating code storage
- It provides a fast, automated, repeatable process that gives confidence every change is releasable (Correct answer)
- It replaces developers with automated scripts for writing code
- It removes the need for staging environments by testing only in production
Correct answer: It provides a fast, automated, repeatable process that gives confidence every change is releasable
A deployment pipeline automates every step from commit to release, making the process repeatable, auditable, and fast so teams can release with confidence at any time.
Question 3: A team wants to test a new feature with only 10% of users before full rollout. Which technique should they use?
- Blue-Green Deployment
- A/B Testing with Feature Flags (Correct answer)
- Rolling Deployment
- Shadow Mode Deployment
Correct answer: A/B Testing with Feature Flags
Feature flags combined with A/B testing allow the new feature to be toggled on for a controlled percentage of users without a separate deployment.
Question 4: What is 'mean time to restore' (MTTR) measuring in the context of CD maturity?
- The average time to build and test a new feature from scratch
- The average time to recover service after a failed deployment or production incident (Correct answer)
- The average time between deployments across a quarter
- The average time developers spend reviewing pull requests
Correct answer: The average time to recover service after a failed deployment or production incident
MTTR measures how quickly a team can restore normal service after a failure, and a low MTTR indicates mature deployment and rollback capabilities.
Question 5: Which CI/CD concept does 'build once, deploy many' refer to?
- Compiling code on each target server before deployment
- Creating a single versioned artifact in CI and promoting the exact same artifact through all environments (Correct answer)
- Building separate container images for development, staging, and production
- Triggering multiple parallel builds from a single commit for redundancy
Correct answer: Creating a single versioned artifact in CI and promoting the exact same artifact through all environments
'Build once, deploy many' ensures the artifact promoted to production is identical to what was tested, eliminating environment-specific build differences.
Question 6: What is the purpose of a 'smoke test' immediately after a deployment in a CD pipeline?
- To run a full regression suite against the newly deployed environment
- To quickly verify that the most critical paths of the application are functional before proceeding (Correct answer)
- To load-test the new deployment with simulated production traffic
- To scan the deployment artifact for security vulnerabilities
Correct answer: To quickly verify that the most critical paths of the application are functional before proceeding
Smoke tests are a small, fast suite that confirms core functionality works after deployment, acting as an early-warning signal before running deeper test suites.
Question 7: In Jenkins, what is a 'Multibranch Pipeline' used for?
- Running a single pipeline across multiple Jenkins controller nodes for redundancy
- Automatically creating pipeline jobs for every branch in a repository (Correct answer)
- Deploying the same application to multiple cloud providers simultaneously
- Splitting a long pipeline into multiple smaller sequential pipelines
Correct answer: Automatically creating pipeline jobs for every branch in a repository
A Jenkins Multibranch Pipeline automatically discovers repository branches and pull requests, creating a separate pipeline job for each one using the repository's Jenkinsfile.
CDM Continuous Integration & Continuous Delivery 4
Which tool category is used in CI pipelines to detect known security vulnerabilities in third-party dependencies?