Discuss Scaled Agile SAFe-DevOps Exam Topic 4 Question 8

Which two security skills are part of the Continuous Integration aspect? (Choose two.)

ASecurity board review

BApplication security

CSOX compliance analysis

DNetwork security practices

EPenetration testing

Suggested Answer: B, E

Two security skills that are part of the Continuous Integration aspect are application security and penetration testing. Application security is the practice of protecting the software applications from malicious attacks, unauthorized access, data breaches, and other threats. It involves applying security principles and techniques throughout the software development lifecycle, such as secure coding, code analysis, code review, security testing, and security monitoring.Application security helps to ensure that the software meets the security requirements and standards, and that it does not introduce any vulnerabilities or risks to the system or the users910

Penetration testing is the practice of simulating real-world attacks on the software applications to identify and exploit any security weaknesses or flaws. It involves using various tools and methods to probe, scan, attack, and bypass the security defenses of the software, such as firewalls, encryption, authentication, and authorization. Penetration testing helps to evaluate the security posture and resilience of the software, and to provide recommendations for improvement or remediation.Penetration testing is usually performed by external or independent experts, who have the permission and authorization to conduct the tests

Get Premium SAFe-DevOps Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

23 comments · newest first

Mona 11 months ago

Wait, is penetration testing really part of CI? Sounds risky!

Josefa 11 months ago

Network security practices are important too, though.

Gerardo 11 months ago

Agreed, B is essential for app security!

Carman 11 months ago

I thought SOX compliance was more about finance?

Rodolfo 12 months ago

Definitely B and E! Those are key for CI.

Gianna 12 months ago

I feel like network security practices are important, but they might not fit directly into Continuous Integration. I’ll have to think about this more.

Stephaine 12 months ago

I might be mixing things up, but I think security board review could be relevant too. It’s hard to remember all the details!

Frank 1 year ago

I remember practicing questions about CI/CD, and I feel like SOX compliance analysis is more about governance than security skills.

Lang 1 year ago

I think application security is definitely one of the skills, but I'm not sure about the second one. Maybe penetration testing?

Candra 1 year ago

I'm feeling pretty confident about this one. Application security and penetration testing are definitely the two security skills that are part of the Continuous Integration aspect. The other options are more about compliance and general security practices, not the specific Continuous Integration process.

Linette 1 year ago

Okay, let's see. Application security and penetration testing seem like obvious choices, since they're directly related to securing the application. The other options like security board review and SOX compliance analysis don't seem as directly relevant to Continuous Integration, but I could be wrong.

Leota 1 year ago

Hmm, this is a tricky one. I know Continuous Integration is all about automating the build and deployment process, but I'm not sure how security fits into that. I'll have to think this through carefully.

Kimi 1 year ago

I think this question is asking about the security skills that are part of the Continuous Integration process. I'm pretty sure application security and penetration testing are two of them, but I'm not 100% sure about the other options.

Shannon 1 year ago

This seems like a straightforward question about business risks. I'll need to carefully consider the options and think about which one poses the biggest threat to Awesome Mobile's operations.

Jerry 1 year ago

I think the key here is understanding which BGP address family is used for MCAST-VPN NLRI. Based on that, I'd say the answer is D, mvpn-ipv4.

Alpha 1 year ago

I'm a bit unsure about the "Always Lossless" option. Isn't it more resource-intensive? It might not be ideal for performance.

My 1 year ago

I think "subordinate" might refer to the processes that rely on the main flow, but I'm not entirely sure if that's right.

Filiberto 2 years ago

I still think Application security is valid. Maybe combine it with Penetration testing. They both secure code constantly.

Demetra 2 years ago

But is Penetration testing always part of CI? Maybe Network security practices?

Kristeen 2 years ago

True, but what about Penetration testing? It's crucial for identifying vulnerabilities.

Filiberto 2 years ago

I think Application security is a must. CI deals directly with apps.

Alline 2 years ago

It's tricky. Security can be broad.

Demetra 2 years ago

What do you think about the Continuous Integration security skills question?

Scaled Agile SAFe-DevOps Exam - Topic 4 Question 8 Discussion