CDP Risk Management & Compliance 5

Question 1

A DevSecOps organization uses a 'policy as code' tool to enforce that no S3 buckets are publicly accessible. This practice best aligns with which compliance concept?

Accepted Answer

Preventive guardrails enforced through automation

Answer

Enforcing infrastructure policies through automated code-based tools implements preventive guardrails that block non-compliant configurations before they reach production.

Question 2

Which concept in supply chain risk management requires validating that software components have not been tampered with between build and deployment?

Accepted Answer

Software integrity verification via cryptographic signing

Answer

Cryptographic signing of build artifacts and verifying signatures at deployment ensures software integrity and detects supply chain tampering.

Question 3

Under the NIST Risk Management Framework (RMF), which step involves selecting an initial set of baseline security controls?

Accepted Answer

Select

Answer

The 'Select' step of the NIST RMF involves choosing appropriate security controls from NIST SP 800-53 based on the system's categorization.

Question 4

What is the key difference between a vulnerability assessment and a penetration test in a DevSecOps risk program?

Accepted Answer

Vulnerability assessments identify weaknesses; pen tests actively exploit them to demonstrate real impact

Answer

Vulnerability assessments identify and catalog potential weaknesses, while penetration tests go further by actively exploiting vulnerabilities to demonstrate actual attack impact.

Question 5

An organization implements data masking in non-production environments to prevent developers from accessing real customer PII. This is an example of which privacy principle?

Accepted Answer

Data minimization in lower environments

Answer

Masking real PII in development and test environments applies data minimization, ensuring that only the minimum necessary data is exposed to personnel who don't require access to real records.

(CDP) Certified DevSecOps Professional Practice Test

(CDP) Certified DevSecOps Professional Practice Test

CDP Risk Management & Compliance 5