CDP Threat Modeling & Vulnerability Management 3

Question 1

What does 'shift-left' security mean in the context of DevSecOps?

Accepted Answer

Integrating security testing and practices earlier in the software development lifecycle

Answer

Moving security team members to left-side offices to improve developer collaboration

Answer

Prioritizing monitoring of left-side network traffic for anomaly detection

Answer

Shifting security responsibilities entirely to the operations team post-deployment

Question 2

What is Software Composition Analysis (SCA) primarily used for in DevSecOps vulnerability management?

Accepted Answer

Identifying vulnerabilities in third-party libraries and open-source dependencies

Answer

Analyzing the security posture of cloud infrastructure configurations

Answer

Scanning custom application logic for business-layer security flaws

Answer

Testing the security of compiled binary executables through disassembly

Question 3

At which stage of a CI/CD pipeline should vulnerability scanning ideally first be integrated?

Accepted Answer

During code commit and pull request creation

Answer

Post-deployment validation in the production environment

Answer

Only during scheduled quarterly security review cycles

Answer

After user acceptance testing has been completed

Question 4

What is the purpose of a Vulnerability Disclosure Policy (VDP)?

Accepted Answer

A formal process enabling external researchers to responsibly report vulnerabilities to an organization

Answer

A policy requiring all CVEs to be publicly disclosed within 90 days of discovery

Answer

An internal policy defining severity thresholds for escalating discovered vulnerabilities

Answer

A regulatory requirement mandating disclosure of data breaches to government authorities

Question 5

What is the primary function of threat intelligence feeds in a vulnerability management program?

Accepted Answer

To provide real-time data about actively exploited vulnerabilities and emerging threats for prioritization

Answer

To automatically apply patches to vulnerabilities without human intervention

Answer

To replace traditional vulnerability scanners with AI-driven detection capabilities

Answer

To generate CVSS scores for newly discovered vulnerabilities before NVD publication

Question 6

In vulnerability management, what is 'risk-based prioritization'?

Accepted Answer

Prioritizing remediation based on exploitability, asset criticality, and actual business impact

Answer

Assigning vulnerability remediation tasks to the highest-paid team members first

Answer

Fixing all discovered vulnerabilities strictly in the chronological order they were found

Answer

Applying patches only to vulnerabilities with a CVSS base score above 7.0

Question 7

What is the role of a bug bounty program in a DevSecOps vulnerability management strategy?

Accepted Answer

Providing financial incentives for external security researchers to discover and responsibly report vulnerabilities

Answer

Rewarding internal developers financially for discovering and fixing the highest number of code bugs

Answer

Automating vulnerability detection in production systems using AI-powered security tooling

Answer

Compensating third-party software vendors for delivering security patches ahead of schedule