CCNA Secure Software Deployment Operations And Management Questions

MCQhard

During an incident response, you identify that a threat actor has gained unauthorized access to an application's environment variables. What is the immediate correct step to take regarding credential management?

A.Clear the application's cache to remove any temporary sensitive data.

B.Increase the logging level to 'DEBUG' to track the attacker's actions.

C.Change the password for the database user and update the application deployment manifest.

D.Re-deploy the application using the same configuration to ensure a clean state.

AnswerC

Credential rotation is the primary remediation for compromised secrets.

Why this answer

When secrets are compromised, they must be considered permanently tainted and rotated immediately to maintain the security posture.

Practice this question →

MCQhard

You are implementing 'Blue-Green' deployment. What is the most critical security step to perform during the cut-over process?

A.Immediately shut down the Blue environment to save costs.

B.Update the load balancer configuration to point to both environments simultaneously.

C.Run automated security integration tests on the Green environment while it is behind the load balancer.

D.Ensure both environments use the same shared database instance.

AnswerC

Verifying security controls in the production-like environment before cut-over prevents vulnerabilities from going live.

Why this answer

Security testing (smoke tests) must be performed on the 'Green' environment before it starts receiving production traffic to ensure the new version is not misconfigured.

Practice this question →

MCQmedium

To ensure secure deployment of software artifacts, you must verify the integrity of the binaries. Which mechanism is most effective for ensuring that artifacts have not been tampered with since they were signed by the build system?

A.Check the file timestamp using the operating system's file system metadata.

B.Upload the artifact to a public VirusTotal scan before deploying.

C.Compare the file size of the artifact with the size listed in the manifest file.

D.Verify the digital signature using a trusted public key from your organization's key store.

AnswerD

Digital signatures provide non-repudiation and integrity verification.

Why this answer

Cryptographic signing (such as GPG or Cosign for containers) creates a verifiable link between the source code and the binary.

Practice this question →

Multi-Selecthard

Which TWO methods are effective in hardening the production environment against 'Zero-Day' vulnerabilities?

Select 2 answers

A.Implementing granular network segmentation to limit lateral movement.

B.Disabling all security logging to prevent alert fatigue.

C.Relying solely on perimeter-based firewalls for security.

D.Updating the application to the latest version once per year.

E.Deploying RASP (Runtime Application Self-Protection) agents to monitor and block malicious behavior.

AnswersA, E

Segmentation limits the blast radius of any exploit.

Why this answer

Defense-in-depth through runtime application self-protection (RASP) and strict network segmentation provides layered security against unknown threats.

Practice this question →

MCQeasy

Which of the following is a primary objective of 'Secure Configuration Management' in the software lifecycle?

A.Maintaining a consistent and hardened state across all environments.

B.Reducing the total cost of ownership of the cloud infrastructure.

C.Ensuring that developers have administrative access to production databases.

D.Maximizing the number of features delivered in each release.

AnswerA

Baseline consistency is essential for reducing the attack surface.

Why this answer

Configuration management ensures that all environments are consistently set up to a known secure baseline, preventing configuration drift.

Practice this question →

MCQhard

You are auditing your software deployment process. Which practice is best to prevent 'Dependency Confusion' attacks where malicious packages are pulled from public registries instead of internal ones?

A.Run all build processes in an isolated network segment without internet access.

B.Define specific versions for all dependencies in a lock file and use a private repository with scoped registries.

C.Use only open-source software libraries.

D.Regularly scan the public registries for malicious packages.

AnswerB

Lock files and scoped registries ensure you are pulling the exact, intended code from trusted locations.

Why this answer

Configuring a private repository manager (like JFrog Artifactory) to prioritize internal scopes and block external lookup for those namespaces prevents dependency confusion.

Practice this question →

MCQeasy

Which of the following is a key component of a 'Secure Software Deployment' plan?

A.A list of all developers who worked on the release.

B.A rollback procedure that allows returning to a known good state.

C.A plan for decommissioning all previous versions of the software.

D.An automated script that changes the administrator password on every server.

AnswerB

Rollback capability is a foundational requirement for operational reliability and security.

Why this answer

A deployment plan must include a rollback procedure in case a critical vulnerability or failure is discovered after release.

Practice this question →

MCQmedium

You are implementing CI/CD pipelines using Jenkins. You need to ensure that container images are scanned for vulnerabilities before they are promoted to production. Which tool integration is most effective for this stage?

A.Configure a post-deployment notification to Slack using a webhook.

B.Manually verify image signatures using Docker Content Trust after deployment.

C.Enable Jenkins 'Build periodically' to scan images in the registry.

D.Use the Jenkins Snyk Security plugin to trigger a scan during the image build step.

AnswerD

Snyk enables automated gates that stop deployment if vulnerabilities meet a defined threshold.

Why this answer

Integrating a tool like Anchore or Snyk directly into the Jenkins pipeline allows for blocking builds that contain known critical vulnerabilities.

Practice this question →

MCQmedium

You are evaluating container orchestration security. What is the purpose of a 'Sidecar Container' in a Service Mesh?

A.To act as a backup for the main container if it crashes.

B.To intercept and manage network traffic to enforce mTLS and authorization policies.

C.To provide additional CPU and memory resources to the main container.

D.To store persistent data for the main application.

AnswerB

The sidecar pattern allows for transparent security enforcement at the network layer.

Why this answer

Sidecars, such as those in Istio or Linkerd, handle security concerns like mTLS, authentication, and logging so the main application code does not have to.

Practice this question →

MCQhard

A security analyst notices anomalous outbound traffic from a containerized microservice that was recently deployed. Which Kubernetes feature should be used to restrict this traffic to only known authorized endpoints?

A.Enable the Kubernetes Audit Log and monitor for kubectl exec commands.

B.Configure PodSecurityPolicies to restrict the containers to non-root users.

C.Install a Service Mesh like Istio to enforce mTLS.

D.Apply a NetworkPolicy object that defines specific egress rules for the application namespace.

AnswerD

NetworkPolicies explicitly define which traffic flows are permitted, effectively mitigating unauthorized egress.

Why this answer

Kubernetes Network Policies are the standard resource for enforcing micro-segmentation and egress traffic control at the pod level.

Practice this question →

MCQmedium

You are managing secure deployment for a Java application. You need to ensure that the application runtime does not have excessive permissions. Which runtime security practice is most effective?

A.Configure a custom Java Security Manager policy file to restrict access to sensitive system resources.

B.Run the Java application as the root user to ensure all permissions are available.

C.Disable the Java Virtual Machine's garbage collection to prevent memory-based attacks.

D.Assign a public IP address to the application server to facilitate remote debugging.

AnswerA

The Security Manager is the native Java tool for restricting application-level access to system resources.

Why this answer

Principle of least privilege at the runtime level involves using Java Security Managers or container isolation to restrict system calls and file access.

Practice this question →

Multi-Selecthard

Which THREE configuration management practices help reduce 'Configuration Drift' in a secure software environment?

Select 3 answers

A.Implementing automated drift detection and remediation tools.

B.Treating infrastructure as 'immutable' by replacing rather than patching instances.

C.Disabling all automated deployment pipelines.

D.Using declarative Infrastructure as Code (IaC) tools like Terraform or CloudFormation.

E.Allowing manual configuration changes via the SSH console.

AnswersA, B, D

Continuous monitoring helps identify and revert unauthorized changes.

Why this answer

Infrastructure as Code, immutable infrastructure, and automated configuration auditing are the pillars of minimizing configuration drift.

Practice this question →

MCQeasy

When managing infrastructure as code (IaC) using Terraform, which practice is the most critical for secure configuration management of state files?

A.Rename the state file to 'secret.tfstate' to hide it from attackers.

B.Store state files in a version-controlled Git repository for change tracking.

C.Use a remote backend like S3 with server-side encryption enabled and restricted IAM policies.

D.Manually delete the state file after every Terraform apply command.

AnswerC

Remote backends allow for central management, encryption at rest, and granular access control.

Why this answer

Terraform state files often contain sensitive information in plain text, making backend encryption and access control mandatory.

Practice this question →

MCQmedium

You are troubleshooting a production incident where a legacy application is performing insecure cryptographic operations. Which feature of a Web Application Firewall (WAF) can best help mitigate the risk while a code fix is being developed?

A.Upgrade the SSL/TLS certificate to a higher bit-length.

B.Deploy a custom WAF rule to block requests containing anomalous cryptographic parameters.

C.Enable HTTP/2 protocol enforcement on the WAF load balancer.

D.Disable the WAF's logging feature to improve response time during the incident.

AnswerB

Custom rules allow for rapid mitigation of specific exploit vectors targeting application logic.

Why this answer

WAFs allow for virtual patching by blocking specific attack patterns before they reach the vulnerable code, buying time for developers.

Practice this question →

MCQmedium

You are deploying a web application to AWS using Elastic Beanstalk. To ensure secure configuration management, you decide to store sensitive database credentials. Which approach is the most secure according to AWS best practices?

A.Use AWS Secrets Manager to inject secrets as environment variables during instance bootstrap.

B.Hardcode the credentials in the application code and use AWS KMS to encrypt the binary at rest.

C.Use the Elastic Beanstalk Console to set plain-text environment properties.

D.Store credentials in the .ebextensions/environment.config file with read-only permissions.

AnswerA

Secrets Manager provides encrypted storage and rotation, which is the industry standard for secure deployment.

Why this answer

AWS Systems Manager Parameter Store with SecureString or AWS Secrets Manager are the recommended ways to handle sensitive application configuration to prevent hardcoding.

Practice this question →

MCQmedium

You are configuring log aggregation for a microservices architecture. Which practice is essential for secure logging management?

A.Implement an automated log masking process to remove sensitive data like session tokens and PII before ingestion.

B.Store all application logs in a publicly accessible S3 bucket for easy debugging.

C.Delete all logs after 24 hours to ensure compliance with the Right to be Forgotten.

D.Increase the log verbosity to the maximum level in production indefinitely.

AnswerA

Data masking protects user privacy and prevents secrets from leaking into logs.

Why this answer

Log files often contain PII or secrets; they must be redacted before storage and access must be strictly controlled.

Practice this question →

Multi-Selecthard

Which THREE security controls are essential when implementing a 'Secure CI/CD' pipeline?

Select 3 answers

A.Using a secure credential vault to inject secrets at runtime.

B.Scanning source code for vulnerabilities using SAST tools.

C.Granting 'Admin' privileges to all developers on the CI/CD server.

D.Isolating build runners in a restricted network segment.

E.Storing pipeline secrets in plain text within the Jenkinsfile.

AnswersA, B, D

Vaults are necessary for managing access to sensitive deployment keys.

Why this answer

Pipeline security requires securing the build environment, scanning the artifacts, and protecting the credentials used for deployment.

Practice this question →

Multi-Selecteasy

Which TWO aspects of the software deployment process directly impact the 'Confidentiality' of the application data?

Select 2 answers

A.The speed at which the deployment occurs.

B.The number of instances deployed in the auto-scaling group.

C.The use of secure vaulting mechanisms for application secrets and keys.

D.The color scheme used in the application UI.

E.Enforcing TLS/SSL for all data in transit between components.

AnswersC, E

Secrets management prevents unauthorized access to sensitive data.

Why this answer

Data encryption during transit and the management of secrets are critical for maintaining confidentiality.

Practice this question →

MCQeasy

When setting up operational monitoring, what is the 'Golden Signal' that specifically indicates a potential Denial of Service (DoS) attack?

A.An increase in the number of developers logged into the system.

B.A decrease in CPU utilization across all servers.

C.A significant increase in the rate of 5xx errors and request latency.

D.A reduction in database write operations.

AnswerC

High error rates and latency often result from resource exhaustion during a DoS attack.

Why this answer

A sudden spike in error rates or latency, combined with high request volume, is a primary indicator of a DoS attack.

Practice this question →

Multi-Selectmedium

Which THREE actions are essential for ensuring a secure Incident Response process for deployed software?

Select 3 answers

A.Maintaining an updated contact list and clear incident escalation paths.

B.Allowing the threat actor to continue accessing the system to observe their tactics.

C.Immediately deleting all production logs to hide the incident from auditors.

D.Conducting a post-mortem analysis to identify root causes and improve future security.

E.Isolating the affected systems to prevent the spread of the attack.

AnswersA, D, E

Preparation ensures a rapid and organized response.

Why this answer

Preparation, containment, and post-incident analysis are critical phases for managing security incidents effectively.

Practice this question →

Multi-Selectmedium

Which TWO security monitoring strategies should be implemented to secure an application during its operational lifecycle?

Select 2 answers

A.Share all internal server IP addresses in the public DNS records.

B.Implement centralized log aggregation with automated alerting for security events.

C.Enforce strict egress filtering policies to block communication with unknown IP addresses.

D.Permit all inbound traffic on port 80 to ensure maximum availability.

E.Disable all egress traffic from the application servers to prevent data exfiltration.

AnswersB, C

Centralized logging is required for observability and incident response.

Why this answer

Log monitoring and egress filtering are essential for detecting and containing active threats in production.

Practice this question →

Multi-Selectmedium

Which TWO actions should be taken when preparing a software build for a secure production deployment?

Select 2 answers

A.Embed hardcoded credentials for the database in the build artifact to ensure connectivity.

B.Bypass unit tests to speed up the deployment pipeline.

C.Perform a Software Composition Analysis (SCA) to identify vulnerable dependencies.

D.Sign the final build artifact using a secure private key.

E.Compile the code with debugging symbols enabled for easier production troubleshooting.

AnswersC, D

SCA is critical for managing open-source risk.

Why this answer

Software composition analysis and signing are essential for verifying the integrity and security of the third-party components and the final artifact.

Practice this question →