CDM Security & Compliance (DevSecOps) Flashcards

What does the term 'shift-left security' mean in a DevSecOps context?

Answer: Integrating security testing and practices early in the development lifecycle

Shift-left security means embedding security checks, code scanning, and threat modeling as early as possible in the SDLC rather than waiting until deployment.

Which practice involves automatically scanning container images for known vulnerabilities before they are pushed to a registry?

Answer: Image vulnerability scanning

Image vulnerability scanning (using tools like Trivy, Clair, or Snyk) checks container images against CVE databases before they reach the registry or production.

In DevSecOps, what is a Software Composition Analysis (SCA) tool primarily used for?

Answer: Identifying vulnerabilities in open-source libraries and dependencies

SCA tools scan a project's dependencies and open-source libraries against vulnerability databases to identify known CVEs and license risks.

Which of the following is the best approach for managing secrets (API keys, passwords) in a CI/CD pipeline?

Answer: Use a dedicated secrets manager such as HashiCorp Vault or AWS Secrets Manager

Dedicated secrets managers provide access control, auditing, rotation, and dynamic secret generation, keeping credentials out of source control entirely.

What is Static Application Security Testing (SAST)?

Answer: Analyzing source code or binaries for security flaws without executing the application

SAST tools analyze source code, bytecode, or binaries at rest to find security vulnerabilities such as SQL injection or buffer overflows before the code runs.

In a DevSecOps pipeline, what does Dynamic Application Security Testing (DAST) do differently from SAST?

Answer: DAST tests a running application by simulating external attacks, while SAST analyzes static code

DAST (black-box testing) interacts with a live running application to discover runtime vulnerabilities that may not be visible in static code analysis.