Fatima Zahra Bennani, a DevSecOps engineer at a Casablanca telecom, needs to verify that a specific compliance control - encryption at rest for all cloud storage buckets - is continuously enforced across the entire AWS environment, not just checked once during initial setup. Which type of tool should Fatima adopt?

• A. Cloud Security Posture Management (CSPM) tool
• B. Static code analyzer for application source
• C. Git commit hook
• D. One-time manual audit spreadsheet

Emma, a DevSecOps engineer, is responsible for maintaining the security and stability of her organization's Jenkins environment. She is concerned that running build jobs directly on the Jenkins controller could expose the system to security risks, such as potential execution of untrusted or malicious build scripts on the controller, increased risk of system instability due to resource-intensive build jobs, unauthorized users modifying job configurations and running harmful commands. To mitigate these risks, Emma needs a solution that isolates build execution from the Jenkins controller while maintaining operational efficiency. Which approach should Emma implement to improve the security of the Jenkins infrastructure?

• A. Disable all scripting capabilities in Jenkins to prevent untrusted code execution.
• B. Use Jenkins agents to run builds instead of executing them on the controller.
• C. Restrict user access to Jenkins job configurations and execution permissions.
• D. Execute all builds in a sandboxed environment on the controller.

Ethan Parker, a DevSecOps engineer at a cloud-based software company, is responsible for securing web applications running in AWS. His team decides to integrate an automated security testing tool within their CI/CD pipeline to identify vulnerabilities during deployment. As part of the DAST phase in their AWS build scanning process, the tool utilizes API credentials to conduct vulnerability scans. When the application is deployed, AWS CodeBuild triggers the scanning process, and if security issues are detected, a Lambda function parses the results and forwards them to AWS Security Hub for further analysis. Which security tool is Ethan's team using?

• A. OWASP ZAP.
• B. AWS Inspector.
• C. ModSecurity.
• D. Burp Suite.

A DevSecOps engineer is responsible for identifying and mitigating security risks across cloud-based deployments and web applications in an enterprise DevSecOps environment. The organization follows a shift-left security approach, ensuring that vulnerabilities are detected early and remediated before deployment. To enhance the security posture, the engineer implements a security solution that provides Continuous monitoring of cloud workloads, automated vulnerability detection and risk assessment, and System hardening to reduce the attack surface. This tool integrates with Azure to identify vulnerable machines, detect compromised systems, and help secure cloud infrastructure. Which security tool is the engineer using?

• A. Tenable.io.
• B. Nexpose.
• C. Burp Suite.
• D. Nikto.

Cindy Williams has recently joined an IT company as a DevSecOps engineer. She configured Bundle-Audit in Travis CI. Cindy detected vulnerability in Gemfile dependencies and resolved it by adding some line of codes. How does Bundler scan Gemfile.lock for insecure versions of gems?

• A. By taking the information from the travis.yml and comparing it with the unknown vulnerabilities.
• B. By taking the information from the Gemfile and comparing it with the unknown vulnerabilities.
• C. By taking the information from the travis.yml file and comparing it with the known vulnerabilities.
• D. By taking the information from the Gemfile and comparing it with the known vulnerabilities.