CDM CDM Security & Compliance (DevSecOps) 1

Question 1

What does the term 'shift-left security' mean in a DevSecOps context?

Accepted Answer

Integrating security testing and practices early in the development lifecycle

Answer

Moving security teams to the left side of the organization chart

Answer

Applying security patches only in the left production environment

Answer

Shifting security budget to earlier fiscal quarters

Question 2

Which practice involves automatically scanning container images for known vulnerabilities before they are pushed to a registry?

Accepted Answer

Image vulnerability scanning

Answer

Runtime threat detection

Answer

Network policy enforcement

Answer

Secrets rotation

Question 3

In DevSecOps, what is a Software Composition Analysis (SCA) tool primarily used for?

Accepted Answer

Identifying vulnerabilities in open-source libraries and dependencies

Answer

Analyzing CPU composition of running services

Answer

Decomposing monoliths into microservices

Answer

Composing software release notes automatically

Question 4

Which of the following is the best approach for managing secrets (API keys, passwords) in a CI/CD pipeline?

Accepted Answer

Use a dedicated secrets manager such as HashiCorp Vault or AWS Secrets Manager

Answer

Hardcode them in the Dockerfile for easy access

Answer

Store them in environment variables committed to the repository

Answer

Encrypt them with Base64 and store in the codebase

Question 5

What is Static Application Security Testing (SAST)?

Accepted Answer

Analyzing source code or binaries for security flaws without executing the application

Answer

Testing an application's security while it is running in production

Answer

Running penetration tests manually on staging environments

Answer

Monitoring network traffic for anomalous patterns

Question 6

In a DevSecOps pipeline, what does Dynamic Application Security Testing (DAST) do differently from SAST?

Accepted Answer

DAST tests a running application by simulating external attacks, while SAST analyzes static code

Answer

DAST scans source code while SAST attacks a running application

Answer

DAST is performed by developers while SAST is performed by security teams only

Answer

DAST only tests APIs while SAST only tests web frontends