CDP Security Automation & Integration 2

Question 1

Which tool is most commonly used to automate static application security testing (SAST) within a CI/CD pipeline?

Accepted Answer

SonarQube

Answer

SonarQube integrates directly into CI/CD pipelines to perform automated static code analysis and identify security vulnerabilities early in development.

Question 2

In a DevSecOps pipeline, what is the primary purpose of a 'security gate'?

Accepted Answer

To block a build from progressing if it fails defined security thresholds

Answer

A security gate automatically halts a pipeline stage when security metrics (e.g., critical CVEs, failed SAST rules) exceed acceptable thresholds, enforcing policy as code.

Question 3

What does 'shift-left security' mean in the context of CI/CD automation?

Accepted Answer

Integrating security testing earlier in the development lifecycle

Answer

Shift-left security means integrating security checks (SAST, dependency scanning, secrets detection) early in development rather than at the end, reducing remediation cost.

Question 4

Which secret management approach is considered best practice when automating deployments?

Accepted Answer

Using a dedicated secrets manager like HashiCorp Vault or AWS Secrets Manager

Answer

Dedicated secrets managers provide dynamic secret generation, access auditing, automatic rotation, and fine-grained access control, which are essential for secure automated deployments.

Question 5

When integrating DAST (Dynamic Application Security Testing) into a pipeline, at which stage should it typically run?

Accepted Answer

After the application is deployed to a test or staging environment

Answer

DAST requires a running application to probe, so it must execute after the application is deployed to a non-production environment where it can send live HTTP requests.

(CDP) Certified DevSecOps Professional Practice Test

(CDP) Certified DevSecOps Professional Practice Test

CDP Security Automation & Integration 2