DOL DOL Security and Compliance 1 — Questions and Answers
Question 1: What is the primary goal of integrating security into the DevOps pipeline (DevSecOps)?
- Slowing releases to allow thorough security audits
- Shifting security left to detect vulnerabilities earlier in the development lifecycle (Correct answer)
- Delegating all security responsibilities to a dedicated team
- Performing security checks only before production deployment
Correct answer: Shifting security left to detect vulnerabilities earlier in the development lifecycle
Shifting security left means embedding security checks early in the pipeline so vulnerabilities are found and fixed at lower cost.
Question 2: Which practice best describes 'security as code' in a DevOps environment?
- Hiring more security engineers
- Storing security policies and configurations in version-controlled code repositories (Correct answer)
- Conducting annual penetration tests
- Isolating security tools from the CI/CD pipeline
Correct answer: Storing security policies and configurations in version-controlled code repositories
Security as code means defining security policies, controls, and configurations in version-controlled scripts so they are auditable, repeatable, and automated.
Question 3: A DevOps Leader wants to ensure compliance checks do not slow deployments. Which approach is most effective?
- Perform manual compliance reviews after each sprint
- Automate compliance validation as a gate in the CI/CD pipeline (Correct answer)
- Skip compliance checks for internal-only services
- Assign compliance review to the project manager
Correct answer: Automate compliance validation as a gate in the CI/CD pipeline
Automating compliance checks as pipeline gates ensures every release is validated without adding manual delay.
Question 4: What does 'threat modeling' help a DevOps team accomplish?
- Forecasting cloud infrastructure costs
- Identifying potential security threats and mitigations early in the design phase (Correct answer)
- Measuring deployment frequency
- Tracking post-release defect rates
Correct answer: Identifying potential security threats and mitigations early in the design phase
Threat modeling proactively identifies attack surfaces and vulnerabilities during design, reducing risk before code is written.
Question 5: Which tool category is commonly used in DevSecOps pipelines to scan container images for known vulnerabilities?
- Static application security testing (SAST)
- Container image vulnerability scanners (Correct answer)
- Log aggregation platforms
- Load balancers
Correct answer: Container image vulnerability scanners
Container image vulnerability scanners (e.g., Trivy, Clair) inspect images against CVE databases before they are deployed.
Question 6: How should a DevOps Leader handle a situation where a security gate is blocking a critical hotfix deployment?
- Always override the gate to maintain deployment speed
- Disable security gates permanently for hotfix branches
- Use a documented, approved exception process with compensating controls and post-deployment remediation (Correct answer)
- Escalate to the security team and wait indefinitely
Correct answer: Use a documented, approved exception process with compensating controls and post-deployment remediation
A documented exception process with compensating controls allows critical fixes while maintaining accountability and ensuring the vulnerability is addressed promptly.
DOL DOL Security and Compliance 1
What is the primary goal of integrating security into the DevOps pipeline (DevSecOps)?