CDM CDM Security & Compliance (DevSecOps) 2 — Questions and Answers
Question 1: Which compliance framework is most commonly referenced for organizations managing payment card data in DevOps pipelines?
- HIPAA
- PCI DSS (Correct answer)
- SOC 2
- GDPR
Correct answer: PCI DSS
PCI DSS (Payment Card Industry Data Security Standard) governs security controls for any organization that processes, stores, or transmits cardholder data.
Question 2: What is the purpose of a 'security gate' in a CI/CD pipeline?
- A physical access control door to the data center
- An automated checkpoint that fails the build if security scan thresholds are exceeded (Correct answer)
- A manual approval step performed only by the CISO
- A firewall rule applied at the network perimeter
Correct answer: An automated checkpoint that fails the build if security scan thresholds are exceeded
A security gate is an automated policy enforcement point in the pipeline that blocks promotion of code if it fails vulnerability, compliance, or quality thresholds.
Question 3: Which principle dictates that each service or user should have only the minimum permissions necessary to perform its function?
- Separation of duties
- Principle of least privilege (Correct answer)
- Defense in depth
- Zero-trust networking
Correct answer: Principle of least privilege
The principle of least privilege limits access rights for accounts, processes, and systems to only what is strictly required, reducing the blast radius of a compromise.
Question 4: What does 'Infrastructure as Code' (IaC) scanning help detect?
- Syntax errors in application business logic
- Misconfigurations and security policy violations in IaC templates before deployment (Correct answer)
- Network latency between microservices at runtime
- Memory leaks in containerized workloads
Correct answer: Misconfigurations and security policy violations in IaC templates before deployment
IaC scanning tools like Checkov or tfsec analyze Terraform, CloudFormation, or Kubernetes manifests to catch insecure defaults and misconfigurations before they are applied.
Question 5: In the context of DevSecOps, what is a 'threat model'?
- A machine learning model that predicts security incidents
- A structured analysis of potential threats, attack vectors, and mitigations for a system (Correct answer)
- A statistical model of past breach data used for compliance reporting
- An ML-based intrusion detection system deployed at the network edge
Correct answer: A structured analysis of potential threats, attack vectors, and mitigations for a system
Threat modeling (e.g., using STRIDE or PASTA) is a design-phase exercise that identifies assets, potential adversaries, attack vectors, and appropriate countermeasures.
Question 6: Which of the following best describes a 'zero-trust' security model in a DevOps environment?
- Trusting all internal network traffic and only verifying external traffic
- Assuming no user or service is trusted by default and requiring continuous verification regardless of network location (Correct answer)
- Allowing developers zero trust in production infrastructure
- Disabling all SSL certificates to reduce configuration complexity
Correct answer: Assuming no user or service is trusted by default and requiring continuous verification regardless of network location
Zero-trust assumes breach and requires explicit verification of every request, enforcing least-privilege access regardless of whether traffic originates inside or outside the network perimeter.
CDM CDM Security & Compliance (DevSecOps) 2
Which compliance framework is most commonly referenced for organizations managing payment card data in DevOps pipelines?