An organization has implemented a DevSecOps model where development, security, and operations teams collaborate from the initial design phase. Instead of treating security as a separate process, these teams jointly design software architectures that incorporate security and compliance requirements from the beginning. This ensures that security is proactively embedded rather than added later in the development cycle. Which DevSecOps process is the organization following?

• A. Continuous Authority to Operate (ATO).
• B. Collaborative Software Design.
• C. Security as Code (SaC).
• D. Orchestration.

Explanation: Only visible for 2Pass4sure members. You can sign-up / login (it's free).

Steven Gerrard has been working as a DevSecOps engineer at an IT company that develops software products and applications related to the healthcare industry. His organization has been using Azure DevOps services to securely and quickly develop software products. To ensure that the deployed infrastructure is in accordance with the architecture and industrial standards and the security policies are appropriately implemented, she would like to integrate InSpec with Azure.
Therefore, after installation and configuration of InSpec, she created InSpec profile file and upgraded it with personal metadata and Azure resource pack information; then she wrote the InSpec tests. Which of the following commands should Steven use to run InSpec tests to check the compliance of Azure infrastructure?

• A. inspec exe inspec-tests/integration/ -it azure://.
• B. inspec exec inspec-tests/integration/ -it azure://.
• C. inspec exe inspec-tests/integration/ -t azure://.
• D. inspec exec inspec-tests/integration/ -t azure://.

Explanation: Only visible for 2Pass4sure members. You can sign-up / login (it's free).

A DevOps team is integrating Splunk with GitLab to monitor their CI/CD pipeline and build status. They have followed the integration steps, including installing the GitLab Add-on from Splunkbase, configuring a GitLab account with the URL and a Personal Access Token in Splunk, setting environment variables for the Splunk HTTP Event Collector (HEC) endpoint and token , and using curl commands in their GitLab pipeline to send data to Splunk. Despite completing the integration, they notice that some pipeline logs are missing in Splunk, while others appear correctly. Upon further investigation, they suspect the issue is related to data formatting and log handling in Splunk. What should the team check to resolve this issue?

• A. Ensure the GitLab Personal Access Token has admin privileges for Splunk API access.
• B. Reinstall the GitLab Add-on from Splunkbase and restart the Splunk service.
• C. Manually export GitLab logs and upload them to Splunk for ingestion.
• D. Update the Splunk source type gitlab_json settings to correctly handle JSON data and adjust TRUNCATE values if needed.

Explanation: Only visible for 2Pass4sure members. You can sign-up / login (it's free).

Emma Williams, a DevSecOps engineer at CyberTech Solutions, is responsible for enhancing security in the Plan stage of the DevSecOps pipeline. To ensure security is embedded early, she performs threat modeling to identify potential risks, architectural flaws, high-risk components, and necessary security controls before development begins. Additionally, Emma ensures that developers receive secure code training and are educated on how to effectively use security tools in their workflow. Which of the following security activities is a key part of the DevSecOps Plan stage and helps in filtering relevant security requirements based on business functionality and performance?

• A. Security Code Review.
• B. Understanding Requirements.
• C. Continuous Security Scanning.
• D. Designing security tools.

Explanation: Only visible for 2Pass4sure members. You can sign-up / login (it's free).

Terry Crews has been working as a DevSecOps engineer at an IT company that develops software products and web applications related to IoT devices. She integrated Sqreen RASP tool with Slack for sending notifications related to security issues to her team. How can Sqreen send notification alerts to Slack?

• A. By creating a cookbook, defining a trigger, security response, and notification.
• B. By creating a cookbook, defining a trigger, Alert a response, and notification.
• C. By creating a playbook, defining a trigger, security response, and notification.
• D. By creating a playbook, defining a trigger, Alert a response, and notification.

Explanation: Only visible for 2Pass4sure members. You can sign-up / login (it's free).