一番質高い 312-97 試験問題集

Liam, a DevSecOps engineer, is responsible for integrating automated security practices into his organization's CI/CD pipeline. The team wants to shift security left by conducting threat modeling early in the development process. To achieve this, Liam chooses a Python-based framework that allows developers to define system components, generate data-flow diagrams (DFDs), sequence diagrams, and produce automated threat model reports. By running simple commands, the team can visualize potential attack surfaces and document security concerns in a structured format. Which approach should Liam take to automate threat modeling in the DevSecOps workflow?

• A. Run static application security testing (SAST) tools for vulnerability detection.
• B. Manually create DFDs and sequence diagrams for each iteration.
• C. Perform penetration testing at the end of the development cycle to identify threats.
• D. Use a Python-based framework to generate threat models, DFDs, and reports automatically.

Bruno Nascimento, a DevSecOps engineer at a Sao Paulo bank, wants to ensure that microservices communicating within his Kubernetes cluster mutually authenticate each other and encrypt all traffic between them, without modifying application code. Which technology should Bruno deploy?

• A. Service mesh with mutual TLS (e.g., Istio)
• B. VPN between developer laptops
• C. WAF at the ingress
• D. Static application firewall rules

You are securing a web application by deploying Invicti Shark IAST within a Dockerized environment. As part of the deployment process, you have successfully downloaded the Shark agent from Invicti Enterprise. To proceed with the setup, the next step is to move the downloaded Shark agent to the correct location on the server. According to the Invicti documentation, you need to create a dedicated directory under the root folder before proceeding with further configurations. What is the first action you should take immediately after downloading the Shark agent to ensure proper deployment?

• A. Create a new directory under the root folder using mkdir /shark/.
• B. Configure Apache with the necessary site configuration files.
• C. Modify the Dockerfile to define the container build process.
• D. Copy the Shark.php file to the directory /shark/.

David, a DevSecOps engineer, is responsible for ensuring the security of his organization's software development lifecycle. During a security review, he notices that developers often embed API keys, database credentials, and other sensitive information directly into the application's source code. David warns that hardcoding credentials poses a serious security risk because attackers could extract sensitive information from leaked or publicly exposed repositories, and unauthorized access to critical systems could occur if credentials are compromised. To address this risk, David recommends implementing a secure system that allows applications to dynamically retrieve sensitive information at runtime without hardcoding them in the source code. Which of the following practices should be implemented to prevent developers from hardcoding secrets in the application's source code?

• A. Network Segmentation.
• B. Secure Container Orchestration.
• C. Secrets Management.
• D. Role-Based Access Control.

Peter McCarthy is working in TetraVerse Soft Solution Pvt. Ltd. as a DevSecOps engineer. His organization develops customized software products and web applications. To develop software products quickly and securely, his organization has been using AWS cloud-based services, including AWS DevOps services. Peter would like to use CloudMapper to examine the AWS cloud environment and perform auditing for security issues. Which of the following privileges should Peter possess in order to collect information about the AWS account?

• A. arn:aws:iam::aws:policy/AWSLambdaFullAccess arn:aws:iam::aws:policy/job- role/ViewOnlyAccess.
• B. arn:aws:iam::aws:policy/SecurityCheck arn:aws:iam::aws:policy/job-function/ViewOnlyAccess::
  EditOnlyAccess.
• C. arn:aws:iam::aws:policy/SecurityAudit arn:aws:iam::aws:policy/job-function/ViewOnlyAccess.
• D. arn:aws:iam::aws:policy/SecurityAudit::SecurityCheck arn:aws:iam::aws:policy/job- role/ViewOnlyAccess:: EditOnlyAccess.