CDP Security Automation & Integration 3 — Questions and Answers
Question 1: A security scan in a CI pipeline produces 200 low-severity findings and 2 critical findings. Which response aligns with DevSecOps best practices?
- Fail the build only on the critical findings and require immediate remediation (Correct answer)
- Fail the build on all 202 findings regardless of severity
- Ignore all findings and proceed to production
- Archive findings and review them quarterly
Correct answer: Fail the build only on the critical findings and require immediate remediation
DevSecOps risk-based policies block builds on critical/high findings while logging lower-severity issues as technical debt to address iteratively, balancing security with delivery velocity.
Question 2: Which Kubernetes-native tool is designed to enforce security policies on pod specifications at admission time?
- Falco
- OPA Gatekeeper (Correct answer)
- Trivy
- Anchore
Correct answer: OPA Gatekeeper
OPA Gatekeeper uses Kubernetes admission webhooks to evaluate pod specs against Rego policies, blocking non-compliant resources before they are created.
Question 3: What is the purpose of container image signing in a DevSecOps pipeline?
- To compress images before pushing to a registry
- To ensure only verified, untampered images are deployed to production (Correct answer)
- To tag images with the build number for tracking
- To scan images for embedded malware
Correct answer: To ensure only verified, untampered images are deployed to production
Image signing tools like Cosign or Notary create a cryptographic signature for each image, allowing deployment pipelines to verify authenticity and integrity before running.
Question 4: In a GitOps workflow, how are security configuration changes typically applied to a Kubernetes cluster?
- By SSHing into nodes and running kubectl commands manually
- By committing changes to a Git repository and letting an operator like Argo CD sync them (Correct answer)
- By uploading YAML files directly through the cloud provider console
- By running Ansible playbooks on the control plane
Correct answer: By committing changes to a Git repository and letting an operator like Argo CD sync them
GitOps uses Git as the single source of truth; operators like Argo CD or Flux continuously reconcile cluster state with the desired state declared in Git, providing full auditability.
Question 5: Which technique is used to detect secrets (API keys, passwords) accidentally committed to a Git repository?
- DAST scanning
- Pre-commit hooks with tools like git-secrets or truffleHog (Correct answer)
- Network traffic analysis
- Fuzzing the build artifacts
Correct answer: Pre-commit hooks with tools like git-secrets or truffleHog
Pre-commit hooks and CI pipeline scanners like truffleHog, detect-secrets, or GitGuardian scan diffs for entropy patterns and known secret formats before or after commits.
Question 6: What is 'infrastructure as code (IaC) security scanning' and why is it integrated into CI/CD?
- Scanning network packets to find infrastructure misconfigurations at runtime
- Analyzing Terraform, CloudFormation, or Helm templates for security misconfigurations before provisioning (Correct answer)
- Monitoring cloud resource costs to prevent budget overruns
- Running pen tests against cloud APIs after deployment
Correct answer: Analyzing Terraform, CloudFormation, or Helm templates for security misconfigurations before provisioning
IaC security scanners like Checkov, tfsec, or KICS analyze infrastructure templates pre-deployment, catching misconfigurations (open S3 buckets, permissive security groups) before they reach production.
Question 7: When automating compliance checks in a pipeline, what does a 'compliance as code' framework like InSpec provide?
- A graphical dashboard for compliance officers to review findings
- Machine-executable tests that verify system configurations against compliance benchmarks like CIS or PCI-DSS (Correct answer)
- Automated patch management for OS vulnerabilities
- Real-time DLP monitoring for data exfiltration
Correct answer: Machine-executable tests that verify system configurations against compliance benchmarks like CIS or PCI-DSS
Chef InSpec allows teams to write compliance tests as code that run automatically, verifying that systems meet defined benchmarks and producing machine-readable audit evidence.
CDP Security Automation & Integration 3
A security scan in a CI pipeline produces 200 low-severity findings and 2 critical findings.
Which response aligns with DevSecOps best practices?