CDM Security & Compliance (DevSecOps) Flashcards

What is the role of audit logging in a DevSecOps-compliant system?

Answer: To provide a tamper-evident record of who did what and when for compliance and forensics

Audit logs capture user actions, system events, and configuration changes in a tamper-evident way, which is essential for compliance audits and post-incident forensics.

Which type of attack does input validation and parameterized queries primarily defend against?

Answer: SQL injection attacks

Parameterized queries and strict input validation prevent attackers from injecting malicious SQL code into database queries through user-supplied input.

In DevSecOps, what is the primary purpose of a Web Application Firewall (WAF)?

Answer: To filter, monitor, and block malicious HTTP traffic targeting web applications

A WAF sits in front of web applications and inspects HTTP/S traffic to block common exploits such as XSS, SQL injection, and OWASP Top 10 attacks.

Which practice ensures that a security vulnerability discovered in a library dependency is automatically tracked and remediated across all affected repositories?

Answer: Automated dependency update tools (e.g., Dependabot, Renovate)

Tools like Dependabot or Renovate scan repositories for outdated or vulnerable dependencies and automatically open pull requests with updated versions.

What does 'SOC 2 Type II' compliance primarily assess?

Answer: That security controls operated effectively over an extended observation period (typically 6–12 months)

SOC 2 Type II evaluates whether a service organization's controls around security, availability, and confidentiality functioned effectively over a defined review period.

What is 'secrets sprawl' and why is it a security concern in DevOps?

Answer: The uncontrolled proliferation of credentials and API keys across codebases, configs, and systems, increasing exposure risk

Secrets sprawl occurs when credentials end up hardcoded in repos, config files, or CI logs, making it difficult to audit, rotate, or revoke them and creating multiple attack surfaces.