CDM CDM Security & Compliance (DevSecOps) 2

Question 1

Which compliance framework is most commonly referenced for organizations managing payment card data in DevOps pipelines?

Accepted Answer

PCI DSS

Answer

PCI DSS (Payment Card Industry Data Security Standard) governs security controls for any organization that processes, stores, or transmits cardholder data.

Question 2

What is the purpose of a 'security gate' in a CI/CD pipeline?

Accepted Answer

An automated checkpoint that fails the build if security scan thresholds are exceeded

Answer

A security gate is an automated policy enforcement point in the pipeline that blocks promotion of code if it fails vulnerability, compliance, or quality thresholds.

Question 3

Which principle dictates that each service or user should have only the minimum permissions necessary to perform its function?

Accepted Answer

Principle of least privilege

Answer

The principle of least privilege limits access rights for accounts, processes, and systems to only what is strictly required, reducing the blast radius of a compromise.

Question 4

What does 'Infrastructure as Code' (IaC) scanning help detect?

Accepted Answer

Misconfigurations and security policy violations in IaC templates before deployment

Answer

IaC scanning tools like Checkov or tfsec analyze Terraform, CloudFormation, or Kubernetes manifests to catch insecure defaults and misconfigurations before they are applied.

Question 5

In the context of DevSecOps, what is a 'threat model'?

Accepted Answer

A structured analysis of potential threats, attack vectors, and mitigations for a system

Answer

Threat modeling (e.g., using STRIDE or PASTA) is a design-phase exercise that identifies assets, potential adversaries, attack vectors, and appropriate countermeasures.

(CDM) Certified DevOps Master Practice Test

(CDM) Certified DevOps Master Practice Test

CDM CDM Security & Compliance (DevSecOps) 2