CDM CDM Security & Compliance (DevSecOps) 1 — Questions and Answers
Question 1: What does the term 'shift-left security' mean in a DevSecOps context?
- Integrating security testing and practices early in the development lifecycle (Correct answer)
- Moving security teams to the left side of the organization chart
- Applying security patches only in the left production environment
- Shifting security budget to earlier fiscal quarters
Correct answer: Integrating security testing and practices early in the development lifecycle
Shift-left security means embedding security checks, code scanning, and threat modeling as early as possible in the SDLC rather than waiting until deployment.
Question 2: Which practice involves automatically scanning container images for known vulnerabilities before they are pushed to a registry?
- Runtime threat detection
- Image vulnerability scanning (Correct answer)
- Network policy enforcement
- Secrets rotation
Correct answer: Image vulnerability scanning
Image vulnerability scanning (using tools like Trivy, Clair, or Snyk) checks container images against CVE databases before they reach the registry or production.
Question 3: In DevSecOps, what is a Software Composition Analysis (SCA) tool primarily used for?
- Analyzing CPU composition of running services
- Identifying vulnerabilities in open-source libraries and dependencies (Correct answer)
- Decomposing monoliths into microservices
- Composing software release notes automatically
Correct answer: Identifying vulnerabilities in open-source libraries and dependencies
SCA tools scan a project's dependencies and open-source libraries against vulnerability databases to identify known CVEs and license risks.
Question 4: Which of the following is the best approach for managing secrets (API keys, passwords) in a CI/CD pipeline?
- Hardcode them in the Dockerfile for easy access
- Store them in environment variables committed to the repository
- Use a dedicated secrets manager such as HashiCorp Vault or AWS Secrets Manager (Correct answer)
- Encrypt them with Base64 and store in the codebase
Correct answer: Use a dedicated secrets manager such as HashiCorp Vault or AWS Secrets Manager
Dedicated secrets managers provide access control, auditing, rotation, and dynamic secret generation, keeping credentials out of source control entirely.
Question 5: What is Static Application Security Testing (SAST)?
- Testing an application's security while it is running in production
- Analyzing source code or binaries for security flaws without executing the application (Correct answer)
- Running penetration tests manually on staging environments
- Monitoring network traffic for anomalous patterns
Correct answer: Analyzing source code or binaries for security flaws without executing the application
SAST tools analyze source code, bytecode, or binaries at rest to find security vulnerabilities such as SQL injection or buffer overflows before the code runs.
Question 6: In a DevSecOps pipeline, what does Dynamic Application Security Testing (DAST) do differently from SAST?
- DAST scans source code while SAST attacks a running application
- DAST tests a running application by simulating external attacks, while SAST analyzes static code (Correct answer)
- DAST is performed by developers while SAST is performed by security teams only
- DAST only tests APIs while SAST only tests web frontends
Correct answer: DAST tests a running application by simulating external attacks, while SAST analyzes static code
DAST (black-box testing) interacts with a live running application to discover runtime vulnerabilities that may not be visible in static code analysis.
CDM CDM Security & Compliance (DevSecOps) 1
What does the term 'shift-left security' mean in a DevSecOps context?