Certified DevSecOps Professional (CDP) — Questions and Answers

Question 1: Which OWASP resource provides a framework for integrating security into the SDLC through maturity levels?

OWASP Juice Shop
OWASP ZAP
OWASP SAMM (Software Assurance Maturity Model) (Correct answer)
OWASP Top 10

Correct answer: OWASP SAMM (Software Assurance Maturity Model)

OWASP SAMM defines measurable maturity levels across security practices to help organizations improve their Secure SDLC systematically.

Question 2: A 'shift-left' security approach in DevSecOps means:

Deploying security patches to production first
Shifting firewall rules to the left network segment
Moving security testing earlier in the development lifecycle (Correct answer)
Left-aligning security dashboards in the UI

Correct answer: Moving security testing earlier in the development lifecycle

Shifting left integrates security checks at the earliest possible stages (design, code, build) rather than only at the end of the cycle.

Question 3: Which Docker best practice reduces the attack surface of a container image?

Installing all development tools in the production image
Using a full OS base image like ubuntu:latest
Using minimal base images such as Alpine or distroless (Correct answer)
Running the container as the root user

Correct answer: Using minimal base images such as Alpine or distroless

Minimal base images contain fewer packages and binaries, reducing the number of potential vulnerabilities present in the image.

Question 4: Which Kubernetes object stores sensitive data such as passwords and tokens?

PersistentVolumeClaim
ConfigMap
Ingress
Secret (Correct answer)

Correct answer: Secret

Kubernetes Secrets are designed to hold sensitive key-value data and can be mounted into pods or accessed via environment variables with RBAC controls.

Question 5: What is the significance of peer review in cloud infrastructure & deployment for CDP professionals?

It promotes accountability, knowledge sharing, and quality improvement (Correct answer)
It replaces the need for self-assessment
It is only relevant for newly certified professionals
It is primarily used for disciplinary purposes

Correct answer: It promotes accountability, knowledge sharing, and quality improvement

Peer review promotes accountability, knowledge sharing, and quality improvement by allowing CDP professionals to benefit from collective expertise and identify areas for growth.

Question 6: What is the primary purpose of threat modeling in the Secure SDLC?

Patch vulnerabilities after release
Automate code deployment
Monitor production systems
Identify and prioritize potential threats early in design (Correct answer)

Correct answer: Identify and prioritize potential threats early in design

Threat modeling proactively identifies potential attack vectors and prioritizes mitigations during the design phase, reducing remediation cost.

Question 7: A Kubernetes PodSecurityContext setting `readOnlyRootFilesystem: true` helps security by:

Disabling network access from the pod
Limiting the number of processes the container can spawn
Preventing the pod from reading secrets
Stopping attackers from writing malicious files to the container filesystem (Correct answer)

Correct answer: Stopping attackers from writing malicious files to the container filesystem

A read-only root filesystem prevents post-exploitation techniques that rely on dropping or modifying binaries inside the container.

Question 8: How does incident response improve security in DevSecOps?

Delays software updates
Ensures security breaches are identified, contained, and mitigated (Correct answer)
Limits compliance
Reduces development speed

Correct answer: Ensures security breaches are identified, contained, and mitigated

Incident response is a critical component of security in DevSecOps because it provides a structured and systematic approach to handling security breaches and incidents. It ensures that when a security event occurs, teams can quickly identify the nature and scope of the breach, contain its impact, and effectively mitigate the threat. This systematic process minimizes damage, reduces downtime, and helps restore normal operations swiftly, protecting data and system integrity.

Question 9: Software Composition Analysis (SCA) is primarily used to:

Encrypt data at rest
Test API endpoints for injection
Monitor user behavior at runtime
Identify vulnerabilities in open-source and third-party dependencies (Correct answer)

Correct answer: Identify vulnerabilities in open-source and third-party dependencies

SCA scans project dependencies against vulnerability databases to flag known CVEs in open-source libraries.

Question 10: How does continuing education relate to cloud infrastructure & deployment for CDP certified professionals?

It is required only for entry-level practitioners
It ensures professionals stay current with evolving standards and best practices (Correct answer)
It is optional and rarely impacts practice quality
It is only needed when changing employers

Correct answer: It ensures professionals stay current with evolving standards and best practices

Continuing education ensures CDP professionals stay current with evolving standards, technologies, and best practices in cloud infrastructure & deployment, maintaining competency throughout their careers.

Question 11: Dynamic Application Security Testing (DAST) differs from SAST because it:

Reviews developer commit history
Checks software licenses
Tests the running application by sending crafted requests (Correct answer)
Scans infrastructure configurations

Correct answer: Tests the running application by sending crafted requests

DAST interacts with a live, running application to discover runtime vulnerabilities such as injection flaws and authentication issues.

Question 12: How does monitoring contribute to risk management?

Increases response time
Allows early detection of threats and vulnerabilities (Correct answer)
Reduces system complexity
Limits risk analysis

Correct answer: Allows early detection of threats and vulnerabilities

Continuous monitoring is essential for risk management in DevSecOps as it provides real-time visibility into the security posture of applications and infrastructure. By constantly observing systems for anomalies, suspicious activities, and new vulnerabilities, monitoring enables the early detection of potential threats. This proactive identification allows teams to respond quickly, mitigate risks, and prevent security incidents from escalating.

Question 13: Which documentation practice is most important for cloud infrastructure & deployment in the CDP field?

Maintaining complete, accurate, and timely records (Correct answer)
Using informal notes instead of official records
Documenting only when legally required
Recording only successful outcomes

Correct answer: Maintaining complete, accurate, and timely records

Maintaining complete, accurate, and timely records is crucial for accountability, quality assurance, and legal compliance in cloud infrastructure & deployment.

Question 14: During post-incident review, a team discovers that alerts were generated but not acted upon for 72 hours. Which process improvement addresses this gap?

Implement alert triage SLAs with escalation procedures and on-call rotations (Correct answer)
Add more monitoring tools to increase alert volume
Move alerting to a weekly digest email
Switch to a signature-only detection model

Correct answer: Implement alert triage SLAs with escalation procedures and on-call rotations

Alert SLAs with defined escalation paths ensure that critical alerts receive a human response within a required timeframe.

Question 15: How should a CDP professional handle a situation where cloud infrastructure & deployment protocols conflict with practical constraints?

Always ignore the protocols in favor of practicality
Make a unilateral decision without consultation
Avoid addressing the conflict entirely
Document the conflict and seek guidance from appropriate authorities (Correct answer)

Correct answer: Document the conflict and seek guidance from appropriate authorities

When protocols conflict with practical constraints, the professional approach is to document the conflict and seek guidance, ensuring transparency and compliance while working toward a resolution.

Question 16: What ethical consideration is most relevant to incident response & disaster recovery in CDP practice?

Prioritizing personal advancement over professional duties
Following only those rules that are convenient
Avoiding all professional development activities
Maintaining confidentiality and acting in the best interest of stakeholders (Correct answer)

Correct answer: Maintaining confidentiality and acting in the best interest of stakeholders

Maintaining confidentiality and acting in the best interest of stakeholders is the cornerstone ethical consideration for incident response & disaster recovery in professional practice.

Question 17: What is the primary purpose of cloud infrastructure & deployment in the context of Certified DevSecOps Professional?

To eliminate the need for ongoing training
To ensure consistent quality and professional accountability (Correct answer)
To replace established industry guidelines
To reduce organizational costs exclusively

Correct answer: To ensure consistent quality and professional accountability

Cloud Infrastructure & Deployment in Certified DevSecOps Professional primarily ensures consistent quality and professional accountability, forming the foundation of competent practice in this field.

Question 18: A security team wants to detect cryptominer deployments in Kubernetes pods in real time. Which monitoring approach is most effective?

Runtime behavioral monitoring for anomalous CPU spikes and outbound connections (Correct answer)
Static analysis of Dockerfiles
Weekly vulnerability scans of container images
Periodic review of pod resource quotas

Correct answer: Runtime behavioral monitoring for anomalous CPU spikes and outbound connections

Runtime behavioral monitoring catches cryptominers by detecting the characteristic CPU exhaustion and unauthorized outbound network connections they produce.

Question 19: Encrypting etcd at rest in Kubernetes is important because etcd:

Stores only pod scheduling metadata
Is used only during cluster upgrades
Contains only network routing tables
Stores all cluster state including Secrets, making it a high-value target (Correct answer)

Correct answer: Stores all cluster state including Secrets, making it a high-value target

etcd holds the entire cluster state including Secret objects in plaintext by default, so encryption at rest protects against unauthorized disk-level access.

Question 20: Which tool category performs Static Application Security Testing (SAST)?

Runtime monitoring agents
Penetration testing frameworks
Network scanners
Source code analyzers (Correct answer)

Correct answer: Source code analyzers

SAST tools analyze source code or compiled binaries without executing the application to detect security flaws.

Question 21: A Software Bill of Materials (SBOM) is important in DevSecOps because it:

Tracks developer sprint velocity
Provides a complete inventory of software components and their versions for vulnerability tracking (Correct answer)
Manages cloud cost allocation
Automates penetration test reports

Correct answer: Provides a complete inventory of software components and their versions for vulnerability tracking

An SBOM gives organizations visibility into every component in their software supply chain, enabling rapid response when new CVEs are disclosed.

Question 22: Running containers as a non-root user is important because:

It enables GPU acceleration
It improves container startup time
It limits the damage an attacker can cause if the container is compromised (Correct answer)
It allows sharing volumes across namespaces

Correct answer: It limits the damage an attacker can cause if the container is compromised

A non-root process cannot modify system files or install packages, containing the impact of a container escape or code execution vulnerability.

Question 23: In Certified DevSecOps Professional, what role does cloud infrastructure & deployment play in ensuring client/stakeholder satisfaction?

It has no direct impact on stakeholder satisfaction
It replaces the need for direct communication
It only matters during initial certification
It builds trust through demonstrated competence and consistency (Correct answer)

Correct answer: It builds trust through demonstrated competence and consistency

Cloud Infrastructure & Deployment builds trust through demonstrated competence and consistency, which directly contributes to stakeholder satisfaction and confidence in the CDP professional.

Question 24: A 'security gate' in a CI/CD pipeline is designed to:

Speed up build times
Notify developers of new features
Block promotion of code that fails security checks (Correct answer)
Archive build artifacts

Correct answer: Block promotion of code that fails security checks

Security gates enforce policy by automatically halting the pipeline when vulnerability thresholds or compliance checks are not met.

Question 25: Which logging standard helps ensure log integrity and non-repudiation in an incident investigation?

Storing logs in the same system that generated them
Retaining logs only for 30 days to reduce storage costs
Forwarding logs to an immutable, centralized, write-once storage system in real time (Correct answer)
Compressing and archiving logs monthly

Correct answer: Forwarding logs to an immutable, centralized, write-once storage system in real time

Immutable, write-once centralized log storage prevents attackers from covering tracks and preserves admissible forensic evidence.

Question 26: When implementing security architecture & network defense practices, what should a CDP professional prioritize first?

Speed of completion over thoroughness
Cost reduction at all levels
Compliance with established standards and protocols (Correct answer)
Personal convenience and efficiency

Correct answer: Compliance with established standards and protocols

Compliance with established standards and protocols must be the first priority, as it ensures safety, quality, and legal adherence in professional practice.

Question 27: An admission controller in Kubernetes is best described as:

A scheduler that places pods on nodes
A tool for collecting container logs
A webhook that intercepts and validates or mutates API requests before they are persisted (Correct answer)
A load balancer for incoming HTTP traffic

Correct answer: A webhook that intercepts and validates or mutates API requests before they are persisted

Admission controllers enforce security policies (e.g., blocking privileged containers) at the API server level before objects are created or modified.

Question 28: What is the risk of storing secrets in environment variables in Kubernetes pods?

They consume excessive memory
They may be exposed in pod logs, crash dumps, or to processes with cluster access (Correct answer)
They prevent the pod from restarting
They cannot be used by the application

Correct answer: They may be exposed in pod logs, crash dumps, or to processes with cluster access

Environment variables are accessible to all processes in a container and can appear in logs or diagnostic output, increasing accidental exposure risk.

Question 29: When implementing cloud infrastructure & deployment practices, what should a CDP professional prioritize first?

Personal convenience and efficiency
Compliance with established standards and protocols (Correct answer)
Cost reduction at all levels
Speed of completion over thoroughness

Correct answer: Compliance with established standards and protocols

Compliance with established standards and protocols must be the first priority, as it ensures safety, quality, and legal adherence in professional practice.

Question 30: What is a common challenge professionals face when applying cloud infrastructure & deployment principles in Certified DevSecOps Professional?

Having too much support from colleagues
Lack of any professional development opportunities
Balancing theoretical knowledge with practical application (Correct answer)
Excessive simplicity of industry regulations

Correct answer: Balancing theoretical knowledge with practical application

Balancing theoretical knowledge with practical application is a well-recognized challenge, as real-world scenarios often present complexities not covered in standard training.

Question 31: What is the purpose of a Service Mesh (e.g., Istio, Linkerd) in a Kubernetes security context?

To manage node OS upgrades
To scan container images for vulnerabilities
To schedule batch jobs in the cluster
To provide mutual TLS (mTLS) encryption and fine-grained traffic policy between services (Correct answer)

Correct answer: To provide mutual TLS (mTLS) encryption and fine-grained traffic policy between services

A service mesh transparently encrypts inter-service traffic with mTLS and enables zero-trust network policies at the application layer.

Question 32: Which open-source tool is widely used in DevSecOps pipelines to scan container images for known vulnerabilities?

Trivy (Correct answer)
Burp Suite
Metasploit
SonarQube

Correct answer: Trivy

Trivy, developed by Aqua Security, is a comprehensive open-source vulnerability scanner for containers, filesystems, IaC, and code repositories commonly integrated into CI/CD pipelines.

Certified DevSecOps Professional (CDP)

The CDP by Practical DevSecOps validates hands-on skills in building secure CI/CD pipelines, integrating SAST/DAST/SCA security testing, container security, cloud infrastructure hardening, and security automation at enterprise scale.

Questions

90 min

Time Limit

80%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

practical-devsecops.com — Test delivery, eligibility, time limit, score validity, fees, registration deadline, renewal, retake fee, retake policy, test dates · verified Oct 2026