CDM Security & Compliance (DevSecOps) Flashcards

Which compliance framework is most commonly referenced for organizations managing payment card data in DevOps pipelines?

Answer: PCI DSS

PCI DSS (Payment Card Industry Data Security Standard) governs security controls for any organization that processes, stores, or transmits cardholder data.

What is the purpose of a 'security gate' in a CI/CD pipeline?

Answer: An automated checkpoint that fails the build if security scan thresholds are exceeded

A security gate is an automated policy enforcement point in the pipeline that blocks promotion of code if it fails vulnerability, compliance, or quality thresholds.

Which principle dictates that each service or user should have only the minimum permissions necessary to perform its function?

Answer: Principle of least privilege

The principle of least privilege limits access rights for accounts, processes, and systems to only what is strictly required, reducing the blast radius of a compromise.

What does 'Infrastructure as Code' (IaC) scanning help detect?

Answer: Misconfigurations and security policy violations in IaC templates before deployment

IaC scanning tools like Checkov or tfsec analyze Terraform, CloudFormation, or Kubernetes manifests to catch insecure defaults and misconfigurations before they are applied.

In the context of DevSecOps, what is a 'threat model'?

Answer: A structured analysis of potential threats, attack vectors, and mitigations for a system

Threat modeling (e.g., using STRIDE or PASTA) is a design-phase exercise that identifies assets, potential adversaries, attack vectors, and appropriate countermeasures.

Which of the following best describes a 'zero-trust' security model in a DevOps environment?

Answer: Assuming no user or service is trusted by default and requiring continuous verification regardless of network location

Zero-trust assumes breach and requires explicit verification of every request, enforcing least-privilege access regardless of whether traffic originates inside or outside the network perimeter.