Exam 300-910 topic 1 question 3 discussion

Actual exam question from Cisco's 300-910

Question #: 3
Topic #: 1

Which two practices help make the security of an application a more integral part of the software development lifecycle? (Choose two.)

A. Add a step to the CI/CD pipeline that runs a dynamic code analysis tool during the pipeline execution.
B. Add a step to the CI/CD pipeline that runs a static code analysis tool during the pipeline execution.
C. Use only software modules that are written by the internal team.
D. Add a step to the CI/CD pipeline to modify the release plan so that updated versions of the software are made available more often.
E. Ensure that the code repository server has enabled drive encryption and stores the keys on a Trusted Platform Module or Hardware Security Module.

Show Suggested Answer

Suggested Answer: AE 🗳️

by JM_Lee at Dec. 4, 2020, 12:16 a.m.

Comments

Submit Cancel

JM_Lee

Highly Voted 3 years, 6 months ago

I'll choose "A & B".

upvoted 14 times

...

examtodo

Most Recent 4 months, 3 weeks ago

Selected Answer: AB

A. Add a step to the CI/CD pipeline that runs a dynamic code analysis tool during the pipeline execution. B. Add a step to the CI/CD pipeline that runs a static code analysis tool during the pipeline execution.

upvoted 1 times

...

psyborg

6 months, 3 weeks ago

Selected Answer: AB

I agree with JM_Lee: A and B are correct. I am certain of B: static code analysis like "bandit" can be used. A is also a good answer, although the study materials don't seem to mention dynamic analysis. C & D are nonsense E. is a valid response, but maybe not as "an integral part of the software development lifecycle"

upvoted 1 times

...