CDP Security Automation & Integration 2 — Questions and Answers
Question 1: Which tool is most commonly used to automate static application security testing (SAST) within a CI/CD pipeline?
- Nessus
- SonarQube (Correct answer)
- Burp Suite
- Metasploit
Correct answer: SonarQube
SonarQube integrates directly into CI/CD pipelines to perform automated static code analysis and identify security vulnerabilities early in development.
Question 2: In a DevSecOps pipeline, what is the primary purpose of a 'security gate'?
- To slow down deployments for manual review
- To block a build from progressing if it fails defined security thresholds (Correct answer)
- To generate security reports for auditors
- To encrypt artifacts before storage
Correct answer: To block a build from progressing if it fails defined security thresholds
A security gate automatically halts a pipeline stage when security metrics (e.g., critical CVEs, failed SAST rules) exceed acceptable thresholds, enforcing policy as code.
Question 3: What does 'shift-left security' mean in the context of CI/CD automation?
- Moving security reviews to the operations team
- Integrating security testing earlier in the development lifecycle (Correct answer)
- Replacing all security tools with open-source alternatives
- Automating penetration testing in production
Correct answer: Integrating security testing earlier in the development lifecycle
Shift-left security means integrating security checks (SAST, dependency scanning, secrets detection) early in development rather than at the end, reducing remediation cost.
Question 4: Which secret management approach is considered best practice when automating deployments?
- Storing secrets in environment variables within the Dockerfile
- Hardcoding secrets in configuration files committed to Git
- Using a dedicated secrets manager like HashiCorp Vault or AWS Secrets Manager (Correct answer)
- Emailing secrets to developers before each deployment
Correct answer: Using a dedicated secrets manager like HashiCorp Vault or AWS Secrets Manager
Dedicated secrets managers provide dynamic secret generation, access auditing, automatic rotation, and fine-grained access control, which are essential for secure automated deployments.
Question 5: When integrating DAST (Dynamic Application Security Testing) into a pipeline, at which stage should it typically run?
- During the code commit phase
- After the application is deployed to a test or staging environment (Correct answer)
- Before dependencies are installed
- During the container image build phase
Correct answer: After the application is deployed to a test or staging environment
DAST requires a running application to probe, so it must execute after the application is deployed to a non-production environment where it can send live HTTP requests.
Question 6: What is the role of Software Composition Analysis (SCA) in a DevSecOps pipeline?
- Analyzing the security of microservice API schemas
- Identifying vulnerabilities and license risks in open-source dependencies (Correct answer)
- Scanning Docker images for misconfigured kernel parameters
- Enforcing TLS settings on web servers
Correct answer: Identifying vulnerabilities and license risks in open-source dependencies
SCA tools scan a project's dependency manifest to detect known CVEs in third-party libraries and flag license compliance issues.
Question 7: Which of the following best describes 'Policy as Code' in a DevSecOps context?
- Writing compliance policies in natural language and storing them in a wiki
- Encoding security and compliance rules in machine-readable files that are version-controlled and automatically enforced (Correct answer)
- Using spreadsheets to track policy exceptions
- Delegating policy decisions to a CISO approval workflow
Correct answer: Encoding security and compliance rules in machine-readable files that are version-controlled and automatically enforced
Policy as Code uses tools like Open Policy Agent (OPA) or Sentinel to express rules in code, enabling automated, consistent, and auditable enforcement within pipelines.
CDP Security Automation & Integration 2
Which tool is most commonly used to automate static application security testing (SAST) within a CI/CD pipeline?