Certified DevSecOps Professional (CDP) — Questions and Answers

Question 1: In a DevSecOps pipeline, integrating container image scanning at which stage provides the earliest feedback?

After deploying to production
Only when a CVE is publicly disclosed
During the CI build, immediately after the image is built (Correct answer)
During the weekly security review meeting

Correct answer: During the CI build, immediately after the image is built

Scanning immediately after the image build in CI ensures vulnerable images are caught and blocked before they reach any deployment environment.

Question 2: A security team uses threat modeling to identify that an attacker could intercept API tokens in transit. Which STRIDE category does this threat belong to?

Spoofing
Elevation of Privilege
Tampering
Information Disclosure (Correct answer)

Correct answer: Information Disclosure

Interception of API tokens in transit constitutes Information Disclosure, as sensitive data is exposed to unauthorized parties.

Question 3: Software Composition Analysis (SCA) is primarily used to:

Identify vulnerabilities in open-source and third-party dependencies (Correct answer)
Monitor user behavior at runtime
Test API endpoints for injection
Encrypt data at rest

Correct answer: Identify vulnerabilities in open-source and third-party dependencies

SCA scans project dependencies against vulnerability databases to flag known CVEs in open-source libraries.

Question 4: What is the primary security risk of using `hostNetwork: true` in a Kubernetes pod spec?

The pod shares the host network namespace, bypassing network segmentation (Correct answer)
The pod cannot mount persistent volumes
The pod uses more CPU than allowed
The pod cannot access other pods

Correct answer: The pod shares the host network namespace, bypassing network segmentation

hostNetwork gives the pod direct access to the node's network interfaces, allowing it to sniff traffic and bypass NetworkPolicy restrictions.

Question 5: Which documentation practice is most important for cloud infrastructure & deployment in the CDP field?

Using informal notes instead of official records
Maintaining complete, accurate, and timely records (Correct answer)
Documenting only when legally required
Recording only successful outcomes

Correct answer: Maintaining complete, accurate, and timely records

Maintaining complete, accurate, and timely records is crucial for accountability, quality assurance, and legal compliance in cloud infrastructure & deployment.

Question 6: How does continuing education relate to cloud infrastructure & deployment for CDP certified professionals?

It is required only for entry-level practitioners
It is only needed when changing employers
It is optional and rarely impacts practice quality
It ensures professionals stay current with evolving standards and best practices (Correct answer)

Correct answer: It ensures professionals stay current with evolving standards and best practices

Continuing education ensures CDP professionals stay current with evolving standards, technologies, and best practices in cloud infrastructure & deployment, maintaining competency throughout their careers.

Question 7: Which threat modeling framework categorizes threats using the STRIDE mnemonic?

VAST (Visual, Agile, and Simple Threat modeling)
OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation)
Microsoft STRIDE (Correct answer)
PASTA (Process for Attack Simulation and Threat Analysis)

Correct answer: Microsoft STRIDE

STRIDE was developed by Microsoft and categorizes threats into Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.

Question 8: What does CVE stand for in the context of vulnerability management?

Common Vulnerability Enumeration
Centralized Vulnerability Engine
Critical Vulnerability Exposure
Common Vulnerabilities and Exposures (Correct answer)

Correct answer: Common Vulnerabilities and Exposures

CVE (Common Vulnerabilities and Exposures) is a standardized list of publicly known security vulnerabilities maintained by MITRE Corporation.

Question 9: Which attack technique involves exploiting a vulnerability inside a container to gain access to the host operating system?

SQL injection
DNS poisoning
Container escape (Correct answer)
Lateral movement

Correct answer: Container escape

Container escape exploits weaknesses in the container runtime or kernel to break out of the container namespace and compromise the host.

Question 10: A Kubernetes Pod Security Admission (PSA) policy set to 'restricted' enforces:

mTLS between all pods in the namespace
Auto-scaling based on CPU metrics
Unlimited resource usage for all pods
A strict security profile requiring non-root, read-only filesystems, and no privilege escalation (Correct answer)

Correct answer: A strict security profile requiring non-root, read-only filesystems, and no privilege escalation

The 'restricted' PSA profile applies the hardest security settings, preventing common container escape techniques and privilege abuse.

Question 11: Fuzz testing (fuzzing) is best described as:

Manually reviewing security policies
Sending random or malformed inputs to an application to uncover unexpected behavior (Correct answer)
Deploying canary releases to production
Encrypting test data before storing it

Correct answer: Sending random or malformed inputs to an application to uncover unexpected behavior

Fuzzing automatically generates unexpected inputs to trigger crashes, hangs, or security exceptions that reveal hidden vulnerabilities.

Question 12: What is the purpose of container image signing in a DevSecOps pipeline?

To compress images before pushing to a registry
To scan images for embedded malware
To tag images with the build number for tracking
To ensure only verified, untampered images are deployed to production (Correct answer)

Correct answer: To ensure only verified, untampered images are deployed to production

Image signing tools like Cosign or Notary create a cryptographic signature for each image, allowing deployment pipelines to verify authenticity and integrity before running.

Question 13: Kubernetes Role-Based Access Control (RBAC) is used to:

Define which users and service accounts can perform actions on cluster resources (Correct answer)
Configure ingress routing rules
Allocate CPU resources to containers
Manage node auto-scaling policies

Correct answer: Define which users and service accounts can perform actions on cluster resources

RBAC binds permissions (Roles/ClusterRoles) to subjects (users, groups, service accounts) to enforce least-privilege access in the cluster.

Question 14: What is the significance of peer review in cloud infrastructure & deployment for CDP professionals?

It promotes accountability, knowledge sharing, and quality improvement (Correct answer)
It is primarily used for disciplinary purposes
It is only relevant for newly certified professionals
It replaces the need for self-assessment

Correct answer: It promotes accountability, knowledge sharing, and quality improvement

Peer review promotes accountability, knowledge sharing, and quality improvement by allowing CDP professionals to benefit from collective expertise and identify areas for growth.

Question 15: Which phase of the Secure SDLC is MOST critical for identifying security requirements before any code is written?

Deployment
Testing
Maintenance
Requirements/Design (Correct answer)

Correct answer: Requirements/Design

Security requirements must be defined during the Requirements/Design phase so that security controls are built in from the start rather than bolted on later.

Question 16: Which CI/CD stage is the most appropriate place to run Interactive Application Security Testing (IAST)?

During automated functional or integration testing while the application is running (Correct answer)
During static code compilation before tests run
After the application is deployed to production
Immediately after code is committed to the repository

Correct answer: During automated functional or integration testing while the application is running

IAST agents instrument the running application during test execution, combining the depth of SAST with the real-execution context of DAST to find vulnerabilities during normal test runs.

Question 17: A 'security gate' in a CI/CD pipeline is designed to:

Speed up build times
Archive build artifacts
Notify developers of new features
Block promotion of code that fails security checks (Correct answer)

Correct answer: Block promotion of code that fails security checks

Security gates enforce policy by automatically halting the pipeline when vulnerability thresholds or compliance checks are not met.

Question 18: A development team wants to prevent third-party dependencies with known critical CVEs from being merged. Which pipeline control achieves this?

Encrypting the dependency manifest file
Adding a manual security review step before every merge
Running DAST scans against the pull request branch
Configuring an SCA tool (e.g., Snyk) as a required pipeline check that fails on critical CVEs (Correct answer)

Correct answer: Configuring an SCA tool (e.g., Snyk) as a required pipeline check that fails on critical CVEs

Configuring SCA tools as required merge checks (branch protection rules) automatically blocks pull requests that introduce dependencies with critical severity vulnerabilities.

Question 19: What is the primary purpose of threat modeling in the Secure SDLC?

Automate code deployment
Monitor production systems
Identify and prioritize potential threats early in design (Correct answer)
Patch vulnerabilities after release

Correct answer: Identify and prioritize potential threats early in design

Threat modeling proactively identifies potential attack vectors and prioritizes mitigations during the design phase, reducing remediation cost.

Question 20: What is a common challenge professionals face when applying automation & scripting fundamentals principles in Certified DevSecOps Professional?

Having too much support from colleagues
Balancing theoretical knowledge with practical application (Correct answer)
Excessive simplicity of industry regulations
Lack of any professional development opportunities

Correct answer: Balancing theoretical knowledge with practical application

Balancing theoretical knowledge with practical application is a well-recognized challenge, as real-world scenarios often present complexities not covered in standard training.

Question 21: What ethical consideration is most relevant to cloud infrastructure & deployment in CDP practice?

Prioritizing personal advancement over professional duties
Following only those rules that are convenient
Maintaining confidentiality and acting in the best interest of stakeholders (Correct answer)
Avoiding all professional development activities

Correct answer: Maintaining confidentiality and acting in the best interest of stakeholders

Maintaining confidentiality and acting in the best interest of stakeholders is the cornerstone ethical consideration for cloud infrastructure & deployment in professional practice.

Question 22: Enabling audit logging in Kubernetes provides security value by:

Recording all requests to the API server for forensic investigation and anomaly detection (Correct answer)
Reducing API server latency
Compressing etcd snapshots automatically
Balancing load across control-plane nodes

Correct answer: Recording all requests to the API server for forensic investigation and anomaly detection

Kubernetes audit logs capture who did what and when in the cluster, supporting incident investigation and compliance requirements.

Question 23: A security scan in a CI pipeline produces 200 low-severity findings and 2 critical findings. Which response aligns with DevSecOps best practices?

Ignore all findings and proceed to production
Fail the build on all 202 findings regardless of severity
Archive findings and review them quarterly
Fail the build only on the critical findings and require immediate remediation (Correct answer)

Correct answer: Fail the build only on the critical findings and require immediate remediation

DevSecOps risk-based policies block builds on critical/high findings while logging lower-severity issues as technical debt to address iteratively, balancing security with delivery velocity.

Question 24: Why is automated patch management important in DevSecOps?

Delays patching
Limits patch coverage
Reduces security compliance
Ensures vulnerabilities are addressed quickly by applying patches (Correct answer)

Correct answer: Ensures vulnerabilities are addressed quickly by applying patches

Automated patch management is vital in DevSecOps because it allows organizations to rapidly identify and apply security patches to systems and applications as soon as they become available. This proactive approach quickly remediates known vulnerabilities, significantly reducing the window of opportunity for attackers to exploit them. It ensures systems remain secure without manual delays.

Question 25: What is the primary security benefit of using immutable infrastructure?

It prevents developers from accessing production systems
It reduces cloud infrastructure costs by right-sizing resources
It eliminates configuration drift and ensures each deployment is from a known-good baseline (Correct answer)
It automatically encrypts all data at rest

Correct answer: It eliminates configuration drift and ensures each deployment is from a known-good baseline

Immutable infrastructure means servers are never patched in place; instead, a new image from a trusted baseline is deployed, eliminating drift and unauthorized changes.

Question 26: A 'shift-left' security approach in DevSecOps means:

Shifting firewall rules to the left network segment
Moving security testing earlier in the development lifecycle (Correct answer)
Left-aligning security dashboards in the UI
Deploying security patches to production first

Correct answer: Moving security testing earlier in the development lifecycle

Shifting left integrates security checks at the earliest possible stages (design, code, build) rather than only at the end of the cycle.

Question 27: What is the purpose of a Service Mesh (e.g., Istio, Linkerd) in a Kubernetes security context?

To provide mutual TLS (mTLS) encryption and fine-grained traffic policy between services (Correct answer)
To schedule batch jobs in the cluster
To scan container images for vulnerabilities
To manage node OS upgrades

Correct answer: To provide mutual TLS (mTLS) encryption and fine-grained traffic policy between services

A service mesh transparently encrypts inter-service traffic with mTLS and enables zero-trust network policies at the application layer.

Question 28: Image scanning in a container registry is used to:

Detect known CVEs in OS packages and application libraries within the image (Correct answer)
Sign images with a developer GPG key
Replicate images across geographic regions
Compress images before pushing

Correct answer: Detect known CVEs in OS packages and application libraries within the image

Registry-integrated scanners check image layers against vulnerability databases and block or alert on images that exceed policy thresholds.

Question 29: Which quality improvement method is most applicable to security architecture & network defense in Certified DevSecOps Professional?

Implementing changes without measuring outcomes
Plan-Do-Check-Act (PDCA) continuous improvement cycle (Correct answer)
Ignoring feedback and maintaining status quo
Making changes only when mandated by regulators

Correct answer: Plan-Do-Check-Act (PDCA) continuous improvement cycle

The PDCA cycle is widely recognized as the most effective quality improvement method, allowing CDP professionals to systematically improve security architecture & network defense practices.

Question 30: What is the primary purpose of cloud infrastructure & deployment in the context of Certified DevSecOps Professional?

To ensure consistent quality and professional accountability (Correct answer)
To replace established industry guidelines
To reduce organizational costs exclusively
To eliminate the need for ongoing training

Correct answer: To ensure consistent quality and professional accountability

Cloud Infrastructure & Deployment in Certified DevSecOps Professional primarily ensures consistent quality and professional accountability, forming the foundation of competent practice in this field.

Question 31: In a shift-left security model, when should security monitoring configurations be defined?

During the staging environment QA pass
During the design and development phase as code (IaC) (Correct answer)
At the start of each quarterly security review
After deployment to production

Correct answer: During the design and development phase as code (IaC)

Shift-left embeds monitoring configuration as infrastructure-as-code during development so alerts and dashboards are ready at deployment.

Question 32: Which Kubernetes object stores sensitive data such as passwords and tokens?

Secret (Correct answer)
Ingress
PersistentVolumeClaim
ConfigMap

Correct answer: Secret

Kubernetes Secrets are designed to hold sensitive key-value data and can be mounted into pods or accessed via environment variables with RBAC controls.

Question 33: How should a CDP professional handle a situation where cloud infrastructure & deployment protocols conflict with practical constraints?

Make a unilateral decision without consultation
Avoid addressing the conflict entirely
Document the conflict and seek guidance from appropriate authorities (Correct answer)
Always ignore the protocols in favor of practicality

Correct answer: Document the conflict and seek guidance from appropriate authorities

When protocols conflict with practical constraints, the professional approach is to document the conflict and seek guidance, ensuring transparency and compliance while working toward a resolution.

Question 34: Interactive Application Security Testing (IAST) works by:

Scanning Docker images for CVEs
Reviewing IaC templates for misconfigurations
Instrumenting the application at runtime to detect vulnerabilities during normal testing (Correct answer)
Fuzzing network protocols

Correct answer: Instrumenting the application at runtime to detect vulnerabilities during normal testing

IAST agents embedded inside the running application observe code execution during tests and report vulnerabilities with precise file and line context.

Question 35: The principle of 'least privilege' in application development means:

Giving developers root access for faster debugging
Requiring manual approval for every code commit
Each component runs with only the permissions it needs to function (Correct answer)
Disabling all logging to minimize data exposure

Correct answer: Each component runs with only the permissions it needs to function

Least privilege limits the blast radius of a compromise by ensuring components cannot access resources beyond their functional requirements.

Question 36: A Software Bill of Materials (SBOM) is important in DevSecOps because it:

Tracks developer sprint velocity
Provides a complete inventory of software components and their versions for vulnerability tracking (Correct answer)
Manages cloud cost allocation
Automates penetration test reports

Correct answer: Provides a complete inventory of software components and their versions for vulnerability tracking

An SBOM gives organizations visibility into every component in their software supply chain, enabling rapid response when new CVEs are disclosed.

Question 37: A Kubernetes PodSecurityContext setting `readOnlyRootFilesystem: true` helps security by:

Limiting the number of processes the container can spawn
Disabling network access from the pod
Preventing the pod from reading secrets
Stopping attackers from writing malicious files to the container filesystem (Correct answer)

Correct answer: Stopping attackers from writing malicious files to the container filesystem

A read-only root filesystem prevents post-exploitation techniques that rely on dropping or modifying binaries inside the container.

Question 38: Dynamic Application Security Testing (DAST) differs from SAST because it:

Checks software licenses
Scans infrastructure configurations
Reviews developer commit history
Tests the running application by sending crafted requests (Correct answer)

Correct answer: Tests the running application by sending crafted requests

DAST interacts with a live, running application to discover runtime vulnerabilities such as injection flaws and authentication issues.

Question 39: Why is real-time alerting important in continuous monitoring?

Ensures immediate notification of threats or vulnerabilities (Correct answer)
Increases manual effort
Reduces monitoring scope
Delays response time

Correct answer: Ensures immediate notification of threats or vulnerabilities

Real-time alerting is a critical feature of continuous monitoring because it ensures immediate notification when predefined thresholds are breached or suspicious activities are detected. This instant communication ensures that security teams are promptly aware of potential threats, vulnerabilities, or anomalies as they emerge. Rapid notification allows for a much quicker response and mitigation, significantly reducing the window of opportunity for attackers and minimizing potential damage.

Question 40: Which risk quantification method expresses risk as a financial expected value using probability distributions?

DREAD scoring
CVSS base scoring
Monte Carlo simulation (FAIR model) (Correct answer)
Heat map risk matrix

Correct answer: Monte Carlo simulation (FAIR model)

The FAIR (Factor Analysis of Information Risk) model combined with Monte Carlo simulation quantifies risk in financial terms using probability ranges for frequency and magnitude.

Question 41: What is the purpose of a 'canary token' in a DevSecOps monitoring strategy?

A performance benchmark for CI/CD pipeline regressions
A rollback mechanism for failed production deployments
A test deployment of new features to a subset of users
A decoy credential or file that triggers an alert when accessed, indicating a breach (Correct answer)

Correct answer: A decoy credential or file that triggers an alert when accessed, indicating a breach

Canary tokens are fake credentials or files planted in sensitive locations; any access triggers an alert because only an attacker would find and use them.

Question 42: Which NIST framework function focuses on developing organizational understanding to manage cybersecurity risk?

Respond
Identify (Correct answer)
Recover
Protect

Correct answer: Identify

The 'Identify' function of the NIST Cybersecurity Framework focuses on developing an understanding of the organizational context needed to manage cybersecurity risk.

Question 43: What is the role of vulnerability scanning in security automation?

Increases manual effort
Delays remediation
Identifies weaknesses in the code and infrastructure (Correct answer)
Reduces team collaboration

Correct answer: Identifies weaknesses in the code and infrastructure

Vulnerability scanning is a key component of security automation in DevSecOps, as it systematically examines applications, systems, and networks for known security flaws. These scans help pinpoint weaknesses, misconfigurations, and potential entry points that attackers could exploit. By automating this process, organizations can continuously identify and prioritize vulnerabilities for remediation, improving their overall security posture.

Question 44: How does automated incident detection improve DevSecOps?

Reduces incident severity
Delays incident response
Increases monitoring complexity
Quickly identifies potential threats and reduces human error (Correct answer)

Correct answer: Quickly identifies potential threats and reduces human error

Automated incident detection significantly improves DevSecOps by leveraging tools and systems to continuously scan and analyze logs, network traffic, and system behavior for indicators of compromise or anomalous activities. This automation drastically speeds up the identification of potential threats compared to manual methods, often detecting issues in real-time. By reducing reliance on human observation for initial detection, it minimizes the risk of human error and ensures a more consistent and rapid response to security incidents.

Question 45: In secure coding, what does 'input validation' primarily protect against?

Unauthorized binary deployments
Injection attacks such as SQL injection and XSS (Correct answer)
Certificate expiration
Slow build pipelines

Correct answer: Injection attacks such as SQL injection and XSS

Validating and sanitizing user input prevents malicious data from being interpreted as commands, blocking injection-class vulnerabilities.

Question 46: Secrets management in the SDLC ensures that:

Feature flags are toggled automatically
All source files are encrypted at rest on developer laptops
API keys and credentials are never hardcoded in source code (Correct answer)
Unit tests run faster in CI pipelines

Correct answer: API keys and credentials are never hardcoded in source code

Hardcoded credentials in source code are easily leaked via version control; secrets should be stored in dedicated vaults and injected at runtime.

Question 47: An admission controller in Kubernetes is best described as:

A webhook that intercepts and validates or mutates API requests before they are persisted (Correct answer)
A scheduler that places pods on nodes
A tool for collecting container logs
A load balancer for incoming HTTP traffic

Correct answer: A webhook that intercepts and validates or mutates API requests before they are persisted

Admission controllers enforce security policies (e.g., blocking privileged containers) at the API server level before objects are created or modified.

Question 48: What does a Kubernetes NetworkPolicy resource control?

The number of pod replicas in a deployment
Resource CPU and memory limits for pods
Which pods can communicate with each other and with external endpoints (Correct answer)
TLS certificate issuance for services

Correct answer: Which pods can communicate with each other and with external endpoints

NetworkPolicy enforces micro-segmentation by defining ingress and egress rules at the pod level, limiting lateral movement in the cluster.

Question 49: At which stage of a CI/CD pipeline should vulnerability scanning ideally first be integrated?

After user acceptance testing has been completed
Only during scheduled quarterly security review cycles
During code commit and pull request creation (Correct answer)
Post-deployment validation in the production environment

Correct answer: During code commit and pull request creation

Vulnerability scanning should begin at the code commit or pull request stage to detect issues as early as possible, when remediation is fastest and least expensive.

Question 50: Which type of testing specifically validates that security controls between microservices are correctly enforced?

Load testing
Integration security testing (Correct answer)
Unit testing
Regression testing

Correct answer: Integration security testing

Integration security testing validates authentication, authorization, and encryption between services, ensuring that trust boundaries are correctly implemented across microservice interactions.

Question 51: Which of the following best describes a key competency required for cloud infrastructure & deployment in CDP certification?

Memorization of all relevant regulations verbatim
Critical thinking and evidence-based decision making (Correct answer)
Delegation of all complex tasks to supervisors
Ability to work independently without any oversight

Correct answer: Critical thinking and evidence-based decision making

Critical thinking and evidence-based decision making is essential for cloud infrastructure & deployment, as professionals must analyze situations and apply knowledge appropriately.

Question 52: Security regression testing in CI/CD is intended to:

Measure application performance under load
Verify that previously fixed vulnerabilities have not been reintroduced (Correct answer)
Generate compliance audit reports automatically
Train machine learning models on security data

Correct answer: Verify that previously fixed vulnerabilities have not been reintroduced

Regression tests for security ensure that code changes do not accidentally reopen vulnerabilities that were previously remediated.

Question 53: Which technology trend is most likely to impact cloud infrastructure & deployment in the CDP field in coming years?

Return to exclusively paper-based systems
Digital tools for enhanced data collection, analysis, and reporting (Correct answer)
Reduction in the need for professional certification
Complete elimination of human professionals

Correct answer: Digital tools for enhanced data collection, analysis, and reporting

Digital tools for enhanced data collection, analysis, and reporting represent the most significant and practical technology trend impacting cloud infrastructure & deployment, augmenting rather than replacing professional expertise.

Question 54: In a Kubernetes environment, which DevSecOps control helps prevent privileged container execution?

Network policies
Horizontal Pod Autoscaler
Service mesh mutual TLS
Pod Security Admission (PSA) / Pod Security Standards (Correct answer)

Correct answer: Pod Security Admission (PSA) / Pod Security Standards

Pod Security Admission enforces Pod Security Standards that restrict dangerous configurations like running containers as root or enabling privileged mode.

Question 55: Running containers as a non-root user is important because:

It allows sharing volumes across namespaces
It limits the damage an attacker can cause if the container is compromised (Correct answer)
It improves container startup time
It enables GPU acceleration

Correct answer: It limits the damage an attacker can cause if the container is compromised

A non-root process cannot modify system files or install packages, containing the impact of a container escape or code execution vulnerability.

Question 56: In threat modeling data flow diagrams, what is a 'trust boundary'?

A firewall rule separating internal and external network segments
A point where data passes between components with different security trust levels (Correct answer)
An SSL/TLS certificate validation checkpoint in an API gateway
A user authentication requirement enforced at the application layer

Correct answer: A point where data passes between components with different security trust levels

Trust boundaries are points in a system where data flows between components or processes that operate at different levels of trust, making them critical areas for threat analysis.

Question 57: What is a common challenge professionals face when applying cloud infrastructure & deployment principles in Certified DevSecOps Professional?

Balancing theoretical knowledge with practical application (Correct answer)
Excessive simplicity of industry regulations
Having too much support from colleagues
Lack of any professional development opportunities

Correct answer: Balancing theoretical knowledge with practical application

Balancing theoretical knowledge with practical application is a well-recognized challenge, as real-world scenarios often present complexities not covered in standard training.

Question 58: In Certified DevSecOps Professional, what role does cloud infrastructure & deployment play in ensuring client/stakeholder satisfaction?

It only matters during initial certification
It builds trust through demonstrated competence and consistency (Correct answer)
It replaces the need for direct communication
It has no direct impact on stakeholder satisfaction

Correct answer: It builds trust through demonstrated competence and consistency

Cloud Infrastructure & Deployment builds trust through demonstrated competence and consistency, which directly contributes to stakeholder satisfaction and confidence in the CDP professional.

Question 59: Encrypting etcd at rest in Kubernetes is important because etcd:

Stores all cluster state including Secrets, making it a high-value target (Correct answer)
Contains only network routing tables
Is used only during cluster upgrades
Stores only pod scheduling metadata

Correct answer: Stores all cluster state including Secrets, making it a high-value target

etcd holds the entire cluster state including Secret objects in plaintext by default, so encryption at rest protects against unauthorized disk-level access.

Question 60: Which SDLC artifact is most useful for ensuring a security review has been completed before release?

Sprint backlog
Marketing launch plan
Security sign-off checklist or security review record (Correct answer)
UX wireframes

Correct answer: Security sign-off checklist or security review record

A formal security review record or sign-off checklist documents that all required security checks were performed and approved before release.

Question 61: When integrating DAST (Dynamic Application Security Testing) into a pipeline, at which stage should it typically run?

During the container image build phase
Before dependencies are installed
After the application is deployed to a test or staging environment (Correct answer)
During the code commit phase

Correct answer: After the application is deployed to a test or staging environment

DAST requires a running application to probe, so it must execute after the application is deployed to a non-production environment where it can send live HTTP requests.

Question 62: Which principle best describes the DevSecOps concept of 'shifting left'?

Integrating security early in the SDLC rather than at the end (Correct answer)
Deploying security controls only in production
Shifting security budget from tools to personnel
Moving security responsibilities to the operations team

Correct answer: Integrating security early in the SDLC rather than at the end

Shifting left means introducing security activities (testing, scanning, reviews) earlier in the development lifecycle to catch issues when they are cheaper to fix.

Question 63: When implementing cloud infrastructure & deployment practices, what should a CDP professional prioritize first?

Speed of completion over thoroughness
Compliance with established standards and protocols (Correct answer)
Personal convenience and efficiency
Cost reduction at all levels

Correct answer: Compliance with established standards and protocols

Compliance with established standards and protocols must be the first priority, as it ensures safety, quality, and legal adherence in professional practice.

Question 64: Which anomaly detection technique is best suited for detecting insider threats in a DevSecOps environment?

User and Entity Behavior Analytics (UEBA) (Correct answer)
Network perimeter firewall rules
Static application security testing
Signature-based IDS rules

Correct answer: User and Entity Behavior Analytics (UEBA)

UEBA establishes behavioral baselines per user and detects deviations like unusual data access or off-hours activity that signatures cannot catch.

Question 65: Which runtime security tool monitors container behavior at runtime to detect anomalous activity such as unexpected system calls?

Trivy
Helm
ArgoCD
Falco (Correct answer)

Correct answer: Falco

Falco uses eBPF or kernel modules to watch system calls and generate alerts when container behavior deviates from defined security rules.

Question 66: Which quality improvement method is most applicable to cloud infrastructure & deployment in Certified DevSecOps Professional?

Implementing changes without measuring outcomes
Ignoring feedback and maintaining status quo
Making changes only when mandated by regulators
Plan-Do-Check-Act (PDCA) continuous improvement cycle (Correct answer)

Correct answer: Plan-Do-Check-Act (PDCA) continuous improvement cycle

The PDCA cycle is widely recognized as the most effective quality improvement method, allowing CDP professionals to systematically improve cloud infrastructure & deployment practices.

Question 67: What is the role of configuration management in security automation?

Limits system maintenance
Automating the setup, maintenance, and monitoring of system configurations (Correct answer)
Reduces compliance
Delays software development

Correct answer: Automating the setup, maintenance, and monitoring of system configurations

Configuration management in security automation involves using tools to define, deploy, and maintain system configurations in a consistent and secure manner. This ensures that all systems adhere to security baselines, preventing misconfigurations that could lead to vulnerabilities. Automation in this area helps enforce security policies across the infrastructure and provides a clear audit trail of changes.

Question 68: Which Docker best practice reduces the attack surface of a container image?

Running the container as the root user
Installing all development tools in the production image
Using a full OS base image like ubuntu:latest
Using minimal base images such as Alpine or distroless (Correct answer)

Correct answer: Using minimal base images such as Alpine or distroless

Minimal base images contain fewer packages and binaries, reducing the number of potential vulnerabilities present in the image.

Question 69: How does security automation improve incident response?

Limits threat detection
Delays response time
Reduces collaboration between teams
Quickly identifies threats and applies predefined responses (Correct answer)

Correct answer: Quickly identifies threats and applies predefined responses

Security automation significantly improves incident response by enabling rapid detection of security threats through automated monitoring and analysis. Once a threat is identified, automated systems can trigger predefined response actions, such as isolating affected systems, blocking malicious traffic, or initiating patching processes. This speed and consistency minimize the impact of incidents and accelerate recovery.

Question 70: Container image signing and verification using tools like Cosign or Notary helps ensure:

Pods restart automatically on failure
Only trusted, unmodified images are deployed in the cluster (Correct answer)
Images are compressed efficiently
Network traffic between pods is encrypted

Correct answer: Only trusted, unmodified images are deployed in the cluster

Image signing creates a cryptographic attestation that verifies the image was built by a trusted source and has not been tampered with.

Question 71: Which type of attack does Software Composition Analysis (SCA) primarily help defend against?

Supply chain attacks through vulnerable third-party dependencies (Correct answer)
Brute-force attacks on authentication endpoints
Cross-site scripting (XSS) in custom application code
Man-in-the-middle attacks on API communications

Correct answer: Supply chain attacks through vulnerable third-party dependencies

SCA tools identify open-source dependencies with known vulnerabilities, licensing issues, or malicious packages, directly targeting software supply chain risk.

Question 72: Which OWASP resource provides a framework for integrating security into the SDLC through maturity levels?

OWASP Juice Shop
OWASP Top 10
OWASP SAMM (Software Assurance Maturity Model) (Correct answer)
OWASP ZAP

Correct answer: OWASP SAMM (Software Assurance Maturity Model)

OWASP SAMM defines measurable maturity levels across security practices to help organizations improve their Secure SDLC systematically.

Question 73: What does the NIST SP 800-137 framework define as continuous monitoring?

Weekly penetration testing of critical systems
Daily vulnerability scanning of production hosts
Real-time alerting on all network traffic
Ongoing awareness of information security, vulnerabilities, and threats to support risk management decisions (Correct answer)

Correct answer: Ongoing awareness of information security, vulnerabilities, and threats to support risk management decisions

NIST SP 800-137 defines continuous monitoring as maintaining ongoing situational awareness to support timely risk management decisions across the information security program.

Question 74: Which OWASP resource is most commonly integrated into DevSecOps pipelines to guide web application security testing?

OWASP MASVS
OWASP ASVS
OWASP SAMM
OWASP Top Ten (Correct answer)

Correct answer: OWASP Top Ten

The OWASP Top Ten is a widely referenced list of the most critical web application security risks and is commonly used to frame automated and manual testing efforts.

Question 75: What is a common challenge professionals face when applying incident response & disaster recovery principles in Certified DevSecOps Professional?

Excessive simplicity of industry regulations
Balancing theoretical knowledge with practical application (Correct answer)
Having too much support from colleagues
Lack of any professional development opportunities

Correct answer: Balancing theoretical knowledge with practical application

Balancing theoretical knowledge with practical application is a well-recognized challenge, as real-world scenarios often present complexities not covered in standard training.

Question 76: Which practice helps developers find and fix security issues before code is merged?

Post-production pen testing
Using only private repositories
Security-focused code review (peer review) (Correct answer)
Disabling branch protection rules

Correct answer: Security-focused code review (peer review)

Security-focused code review catches flaws such as logic errors and insecure patterns before they are merged into the main branch.

Question 77: Dependency pinning in package management is a security best practice because it:

Prevents unexpected updates that could introduce vulnerabilities or supply-chain attacks (Correct answer)
Speeds up CI/CD pipeline runs
Enables automatic hotfix deployments
Reduces container image size

Correct answer: Prevents unexpected updates that could introduce vulnerabilities or supply-chain attacks

Pinning dependencies to exact versions ensures builds are reproducible and prevents a compromised package update from silently entering the build.

Question 78: What is the main goal of DevSecOps?

Increase profitability
Reduce testing time
Integrate security practices within the DevOps process (Correct answer)
Focus on development speed

Correct answer: Integrate security practices within the DevOps process

DevSecOps aims to embed security throughout the entire software development lifecycle, rather than treating it as a separate, late-stage activity. This integration ensures that security considerations are part of every phase, from design and development to testing and deployment. The goal is to build secure software from the ground up, making security a shared responsibility across development, operations, and security teams.

Question 79: What is the risk of storing secrets in environment variables in Kubernetes pods?

They consume excessive memory
They cannot be used by the application
They may be exposed in pod logs, crash dumps, or to processes with cluster access (Correct answer)
They prevent the pod from restarting

Correct answer: They may be exposed in pod logs, crash dumps, or to processes with cluster access

Environment variables are accessible to all processes in a container and can appear in logs or diagnostic output, increasing accidental exposure risk.

Question 80: Which tool category performs Static Application Security Testing (SAST)?

Penetration testing frameworks
Network scanners
Runtime monitoring agents
Source code analyzers (Correct answer)

Correct answer: Source code analyzers

SAST tools analyze source code or compiled binaries without executing the application to detect security flaws.

Certified DevSecOps Professional (CDP)

The CDP by Practical DevSecOps validates hands-on skills in building secure CI/CD pipelines, integrating SAST/DAST/SCA security testing, container security, cloud infrastructure hardening, and security automation at enterprise scale.

Questions

90 min

Time Limit

80%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds