A DevSecOps team is working on an Azure DevOps project and wants to enhance security by configuring GitHub Advanced Security (GHAS). One of their primary concerns is the accidental exposure of sensitive information-such as API keys, credentials, and other confidential data-when developers push code to the repository. To mitigate this risk, the team is looking for a solution that can automatically detect and block sensitive information before it gets committed, ensuring that such data never reaches the repository. Which GHAS feature should the team enable to achieve this level of protection?

• A. Dependency Scanning.
• B. Secret Scanning Push Protection.
• C. Code Scanning.
• D. Repository-Level Onboarding.

A multinational e-commerce company has been following the Waterfall methodology for years to develop its internal applications. However, the company has been facing challenges in keeping up with frequent market changes, leading to delays in product releases. The development team struggles with late-stage problem identification, as issues cannot be addressed until the repair phase. Additionally, customers often report that the final product does not fully meet their expectations due to misalignment in project requirements. To overcome these challenges, the company's leadership has decided to transition to a more iterative and flexible software development approach that allows continuous testing, faster releases, and incremental enhancements based on feedback. Which software development methodology should the company adopt to resolve these issues?

• A. Waterfall methodology.
• B. DevOps methodology.
• C. V-Model methodology.
• D. Agile methodology.

Jordon Garrett has recently joined a startup IT company located in Chicago, Illinois, as a DevSecOps engineer. His team leader asked him to find a SAST tool that can secure the organization Azure environment. Which of the following is a SAST tool that Jordon can select to secure his organization's Azure environment?

• A. Accurics.
• B. Coverity.
• C. Tenable.io.
• D. DevSkim.

During a software development sprint, Maria, a DevSecOps team lead, is responsible for implementing a security strategy to identify vulnerabilities in the software lifecycle. After assessing her team's workflow, she realizes during development, they need a security approach that can identify logic errors and data flow issues early, before the application is deployed. During production, they require a real-time security mechanism to detect runtime threats and prevent active attacks without disrupting normal application functionality. Which combination of security testing methods should Maria recommend to meet both requirements effectively?

• A. SAST for development and RASP for production.
• B. RASP for development and IAST for production.
• C. IAST for development and DAST for production.
• D. DAST for development and SAST for production.

Ryan, a VP of Engineering at a cloud-based SaaS company, is struggling with bottlenecks in the software delivery pipeline. Despite following DevOps practices, the company faces delays in feature releases, misalignment between development and business objectives, and inefficiencies in tracking work progress from initial planning to deployment. During an internal review, Ryan identifies two major areas of concern that are customer-facing operational inefficiencies, including slow service updates and lack of real-time support improvements, and development process inefficiencies, such as frequent handoffs, testing delays, and a lack of visibility into how coding efforts translate into business value. To address these challenges, Ryan has requested a structured approach that allows the organization to map, measure, and optimize the flow of value from software development to customer delivery. Which framework should Ryan adopt?

• A. Culture, Automation, Lean, Measurement, and Sharing (CALMS).
• B. DevOps Value Stream Management (DVSM).
• C. CI/CD Pipeline Model.
• D. DevOps Maturity Model.