A fintech company recently suffered a data breach caused by a vulnerability in their web application. Upon investigation, the security team discovered that their reliance on manual vulnerability testing had failed to identify critical attack vectors that adversaries exploited. To prevent similar incidents, the company wants to enhance its DevSecOps pipeline by integrating a security solution that can automatically detect vulnerabilities in the running application and identify potential attack paths. Which approach should the company adopt to improve security in the production environment?

• A. Require developers to follow a manual security checklist during code reviews.
• B. Integrate Dynamic Application Security Testing (DAST) tools.
• C. Deploy a Web Application Firewall (WAF).
• D. Implement Static Application Security Testing (SAST) tools.

Alexander Hamilton has been working as a senior DevSecOps engineer in an IT company located in Greenville, South Carolina. In January of 2012, his organization because a victim of a cyber security attack and incurred a tremendous loss. Alexander's organization immediately adopted AWS cloud-based services after the attack to develop robust software products securely and quickly. To detect security issues in code review, Alexander would like to integrate SonarQube with AWS Pipeline; therefore, he created a pipeline in AWS using CloudFormation pipeline template. Then, he selected SonarQube tool from the tools dropdown, provided the required stack parameters, and also provided email address for receiving email notifications of changes in pipeline status and approvals. He deployed the pipeline after entering the required information. What will happen when changes are committed in the application repository?

• A. Security Hub event is created.
• B. Cloud Config event is created.
• C. CloudWatch event is created.
• D. BinSkim event is created.

Joe Adler has recently been offered a job as a DevSecOps engineer in an IT company that develops software products and web applications for the healthcare industry. He would like to implement DevSec Hardening Framework to add a layer into the automation framework that configures operating systems and services and takes care of difficult settings, compliance guidelines, cryptography recommendations, and secure defaults. To apply DevSec Hardening Framework to the machine, he scanned the machine using Nessus scanning tool; he then checked the compliance results before using DevSec Hardening Framework. Which of the following commands should Joe use to run DevSec Hardening Framework?

• A. Chef-solo -m solo.rb -h solo.json.
• B. Chef-solo -j solo.rb -c solo.json.
• C. Chef-solo -c solo.rb -j solo.json.
• D. Chef-solo -h solo.rb -m solo.json.

Ethan Roberts, a DevSecOps engineer at SecureSoft Technologies, is responsible for securing software products and web applications throughout the development lifecycle. To enhance security testing, he implements Interactive Application Security Testing (IAST), which allows him to analyze source code for vulnerabilities in real-time, monitor security issues dynamically as the application runs, utilize IAST across the development, QA, and production stages to identify vulnerabilities early, and reduce remediation costs by detecting issues before deployment. Ethan's team is particularly interested in how IAST integrates both SAST and DAST capabilities. They observe that IAST can analyze every line of code statically (SAST) and examine every request and response dynamically (DAST). How does IAST achieve this dual functionality?

• A. Because IAST has access to both internal and external security agents.
• B. Because IAST has access to both the server and local machine.
• C. Because IAST has access to offline and runtime environments.
• D. Because IAST has access to the source code and HTTP traffic.

Ethan Reynolds, a DevSecOps Engineer at Innovatech Solutions, is responsible for enforcing security measures in the company's code repositories. His team follows best practices to prevent sensitive data from being committed. One of the software developers, Lily Thompson, asked Ethan for help in making pre-commit hooks executable on her local machine. Ethan navigated to the repo's .git/hooks/ directory, removed the .sample extension from the pre-commit.sample file, and ran the chmod +x command to make it executable. The next day, while developing new features, Lily unintentionally committed code containing sensitive information. However, the pre-commit hook detected this issue and enforced security restrictions. What will be the result of this commit attempt?

• A. The commit will proceed, but a warning will be logged, and the script will exit with 2.
• B. The commit will be allowed, and the script will exit with 0.
• C. The commit will be blocked until manual approval, and the script will exit with 3.
• D. The commit will be rejected, and the script will exit with 1.