Certified DevSecOps Professional (CDP) — Questions and Answers

Question 1: In threat modeling data flow diagrams, what is a 'trust boundary'?

A user authentication requirement enforced at the application layer
A firewall rule separating internal and external network segments
A point where data passes between components with different security trust levels (Correct answer)
An SSL/TLS certificate validation checkpoint in an API gateway

Correct answer: A point where data passes between components with different security trust levels

Trust boundaries are points in a system where data flows between components or processes that operate at different levels of trust, making them critical areas for threat analysis.

Question 2: Which technology trend is most likely to impact cloud infrastructure & deployment in the CDP field in coming years?

Complete elimination of human professionals
Return to exclusively paper-based systems
Digital tools for enhanced data collection, analysis, and reporting (Correct answer)
Reduction in the need for professional certification

Correct answer: Digital tools for enhanced data collection, analysis, and reporting

Digital tools for enhanced data collection, analysis, and reporting represent the most significant and practical technology trend impacting cloud infrastructure & deployment, augmenting rather than replacing professional expertise.

Question 3: A Software Bill of Materials (SBOM) is important in DevSecOps because it:

Tracks developer sprint velocity
Automates penetration test reports
Manages cloud cost allocation
Provides a complete inventory of software components and their versions for vulnerability tracking (Correct answer)

Correct answer: Provides a complete inventory of software components and their versions for vulnerability tracking

An SBOM gives organizations visibility into every component in their software supply chain, enabling rapid response when new CVEs are disclosed.

Question 4: Image scanning in a container registry is used to:

Detect known CVEs in OS packages and application libraries within the image (Correct answer)
Compress images before pushing
Sign images with a developer GPG key
Replicate images across geographic regions

Correct answer: Detect known CVEs in OS packages and application libraries within the image

Registry-integrated scanners check image layers against vulnerability databases and block or alert on images that exceed policy thresholds.

Question 5: Which runtime security tool monitors container behavior at runtime to detect anomalous activity such as unexpected system calls?

ArgoCD
Helm
Falco (Correct answer)
Trivy

Correct answer: Falco

Falco uses eBPF or kernel modules to watch system calls and generate alerts when container behavior deviates from defined security rules.

Question 6: In DevSecOps, what is a 'golden image' or 'golden AMI'?

A snapshot of a production environment used for disaster recovery
An image that has passed all DAST scans without findings
A container image stored in a private registry with no public access
A hardened, pre-approved base image used as the starting point for all deployments (Correct answer)

Correct answer: A hardened, pre-approved base image used as the starting point for all deployments

A golden image is a pre-hardened, security-approved base image (OS + dependencies) built and scanned centrally so all teams start from a known-secure foundation.

Question 7: What is a common challenge professionals face when applying cloud infrastructure & deployment principles in Certified DevSecOps Professional?

Excessive simplicity of industry regulations
Having too much support from colleagues
Lack of any professional development opportunities
Balancing theoretical knowledge with practical application (Correct answer)

Correct answer: Balancing theoretical knowledge with practical application

Balancing theoretical knowledge with practical application is a well-recognized challenge, as real-world scenarios often present complexities not covered in standard training.

Question 8: What does 'shift-left' security mean in the context of DevSecOps?

Shifting security responsibilities entirely to the operations team post-deployment
Integrating security testing and practices earlier in the software development lifecycle (Correct answer)
Prioritizing monitoring of left-side network traffic for anomaly detection
Moving security team members to left-side offices to improve developer collaboration

Correct answer: Integrating security testing and practices earlier in the software development lifecycle

'Shift-left' refers to moving security practices earlier in the SDLC—integrating them during design and development rather than discovering issues post-deployment.

Question 9: Dependency pinning in package management is a security best practice because it:

Enables automatic hotfix deployments
Speeds up CI/CD pipeline runs
Prevents unexpected updates that could introduce vulnerabilities or supply-chain attacks (Correct answer)
Reduces container image size

Correct answer: Prevents unexpected updates that could introduce vulnerabilities or supply-chain attacks

Pinning dependencies to exact versions ensures builds are reproducible and prevents a compromised package update from silently entering the build.

Question 10: What is the primary security risk of using `hostNetwork: true` in a Kubernetes pod spec?

The pod shares the host network namespace, bypassing network segmentation (Correct answer)
The pod cannot access other pods
The pod uses more CPU than allowed
The pod cannot mount persistent volumes

Correct answer: The pod shares the host network namespace, bypassing network segmentation

hostNetwork gives the pod direct access to the node's network interfaces, allowing it to sniff traffic and bypass NetworkPolicy restrictions.

Question 11: Which practice helps developers find and fix security issues before code is merged?

Disabling branch protection rules
Post-production pen testing
Security-focused code review (peer review) (Correct answer)
Using only private repositories

Correct answer: Security-focused code review (peer review)

Security-focused code review catches flaws such as logic errors and insecure patterns before they are merged into the main branch.

Question 12: Which documentation practice is most important for automation & scripting fundamentals in the CDP field?

Using informal notes instead of official records
Documenting only when legally required
Recording only successful outcomes
Maintaining complete, accurate, and timely records (Correct answer)

Correct answer: Maintaining complete, accurate, and timely records

Maintaining complete, accurate, and timely records is crucial for accountability, quality assurance, and legal compliance in automation & scripting fundamentals.

Question 13: Which Docker best practice reduces the attack surface of a container image?

Running the container as the root user
Installing all development tools in the production image
Using minimal base images such as Alpine or distroless (Correct answer)
Using a full OS base image like ubuntu:latest

Correct answer: Using minimal base images such as Alpine or distroless

Minimal base images contain fewer packages and binaries, reducing the number of potential vulnerabilities present in the image.

Question 14: What ethical consideration is most relevant to cloud infrastructure & deployment in CDP practice?

Avoiding all professional development activities
Prioritizing personal advancement over professional duties
Maintaining confidentiality and acting in the best interest of stakeholders (Correct answer)
Following only those rules that are convenient

Correct answer: Maintaining confidentiality and acting in the best interest of stakeholders

Maintaining confidentiality and acting in the best interest of stakeholders is the cornerstone ethical consideration for cloud infrastructure & deployment in professional practice.

Question 15: How should a CDP professional handle a situation where cloud infrastructure & deployment protocols conflict with practical constraints?

Document the conflict and seek guidance from appropriate authorities (Correct answer)
Make a unilateral decision without consultation
Avoid addressing the conflict entirely
Always ignore the protocols in favor of practicality

Correct answer: Document the conflict and seek guidance from appropriate authorities

When protocols conflict with practical constraints, the professional approach is to document the conflict and seek guidance, ensuring transparency and compliance while working toward a resolution.

Question 16: During post-incident review, a team discovers that alerts were generated but not acted upon for 72 hours. Which process improvement addresses this gap?

Implement alert triage SLAs with escalation procedures and on-call rotations (Correct answer)
Add more monitoring tools to increase alert volume
Switch to a signature-only detection model
Move alerting to a weekly digest email

Correct answer: Implement alert triage SLAs with escalation procedures and on-call rotations

Alert SLAs with defined escalation paths ensure that critical alerts receive a human response within a required timeframe.

Question 17: Which OWASP resource provides a framework for integrating security into the SDLC through maturity levels?

OWASP SAMM (Software Assurance Maturity Model) (Correct answer)
OWASP Juice Shop
OWASP Top 10
OWASP ZAP

Correct answer: OWASP SAMM (Software Assurance Maturity Model)

OWASP SAMM defines measurable maturity levels across security practices to help organizations improve their Secure SDLC systematically.

Question 18: Which of the following best describes a key competency required for cloud infrastructure & deployment in CDP certification?

Delegation of all complex tasks to supervisors
Memorization of all relevant regulations verbatim
Ability to work independently without any oversight
Critical thinking and evidence-based decision making (Correct answer)

Correct answer: Critical thinking and evidence-based decision making

Critical thinking and evidence-based decision making is essential for cloud infrastructure & deployment, as professionals must analyze situations and apply knowledge appropriately.

Question 19: Secrets management in the SDLC ensures that:

All source files are encrypted at rest on developer laptops
Feature flags are toggled automatically
Unit tests run faster in CI pipelines
API keys and credentials are never hardcoded in source code (Correct answer)

Correct answer: API keys and credentials are never hardcoded in source code

Hardcoded credentials in source code are easily leaked via version control; secrets should be stored in dedicated vaults and injected at runtime.

Question 20: Which control type is a firewall that blocks malicious traffic before it reaches an application?

Corrective control
Detective control
Preventive control (Correct answer)
Compensating control

Correct answer: Preventive control

A firewall is a preventive control because it stops threats before they can cause harm, rather than detecting or correcting after the fact.

Question 21: Dynamic Application Security Testing (DAST) differs from SAST because it:

Scans infrastructure configurations
Tests the running application by sending crafted requests (Correct answer)
Checks software licenses
Reviews developer commit history

Correct answer: Tests the running application by sending crafted requests

DAST interacts with a live, running application to discover runtime vulnerabilities such as injection flaws and authentication issues.

Question 22: What is the primary purpose of threat modeling in the Secure SDLC?

Monitor production systems
Identify and prioritize potential threats early in design (Correct answer)
Automate code deployment
Patch vulnerabilities after release

Correct answer: Identify and prioritize potential threats early in design

Threat modeling proactively identifies potential attack vectors and prioritizes mitigations during the design phase, reducing remediation cost.

Question 23: An admission controller in Kubernetes is best described as:

A tool for collecting container logs
A load balancer for incoming HTTP traffic
A scheduler that places pods on nodes
A webhook that intercepts and validates or mutates API requests before they are persisted (Correct answer)

Correct answer: A webhook that intercepts and validates or mutates API requests before they are persisted

Admission controllers enforce security policies (e.g., blocking privileged containers) at the API server level before objects are created or modified.

Question 24: Encrypting etcd at rest in Kubernetes is important because etcd:

Is used only during cluster upgrades
Contains only network routing tables
Stores only pod scheduling metadata
Stores all cluster state including Secrets, making it a high-value target (Correct answer)

Correct answer: Stores all cluster state including Secrets, making it a high-value target

etcd holds the entire cluster state including Secret objects in plaintext by default, so encryption at rest protects against unauthorized disk-level access.

Question 25: A 'security gate' in a CI/CD pipeline is designed to:

Block promotion of code that fails security checks (Correct answer)
Speed up build times
Archive build artifacts
Notify developers of new features

Correct answer: Block promotion of code that fails security checks

Security gates enforce policy by automatically halting the pipeline when vulnerability thresholds or compliance checks are not met.

Question 26: What is the risk of storing secrets in environment variables in Kubernetes pods?

They cannot be used by the application
They prevent the pod from restarting
They consume excessive memory
They may be exposed in pod logs, crash dumps, or to processes with cluster access (Correct answer)

Correct answer: They may be exposed in pod logs, crash dumps, or to processes with cluster access

Environment variables are accessible to all processes in a container and can appear in logs or diagnostic output, increasing accidental exposure risk.

Question 27: What is the primary purpose of cloud infrastructure & deployment in the context of Certified DevSecOps Professional?

To ensure consistent quality and professional accountability (Correct answer)
To eliminate the need for ongoing training
To reduce organizational costs exclusively
To replace established industry guidelines

Correct answer: To ensure consistent quality and professional accountability

Cloud Infrastructure & Deployment in Certified DevSecOps Professional primarily ensures consistent quality and professional accountability, forming the foundation of competent practice in this field.

Question 28: Container image signing and verification using tools like Cosign or Notary helps ensure:

Only trusted, unmodified images are deployed in the cluster (Correct answer)
Images are compressed efficiently
Network traffic between pods is encrypted
Pods restart automatically on failure

Correct answer: Only trusted, unmodified images are deployed in the cluster

Image signing creates a cryptographic attestation that verifies the image was built by a trusted source and has not been tampered with.

Question 29: In a risk register, what does 'residual risk' represent?

Risk scored before any analysis is performed
Risk inherited from a supply chain vendor
Risk that remains after controls have been applied (Correct answer)
Risk eliminated after applying security controls

Correct answer: Risk that remains after controls have been applied

Residual risk is the level of risk that persists after all planned risk treatments and security controls have been implemented.

Question 30: Which quality improvement method is most applicable to cloud infrastructure & deployment in Certified DevSecOps Professional?

Plan-Do-Check-Act (PDCA) continuous improvement cycle (Correct answer)
Implementing changes without measuring outcomes
Ignoring feedback and maintaining status quo
Making changes only when mandated by regulators

Correct answer: Plan-Do-Check-Act (PDCA) continuous improvement cycle

The PDCA cycle is widely recognized as the most effective quality improvement method, allowing CDP professionals to systematically improve cloud infrastructure & deployment practices.

Question 31: In a GitOps workflow, how are security configuration changes typically applied to a Kubernetes cluster?

By committing changes to a Git repository and letting an operator like Argo CD sync them (Correct answer)
By running Ansible playbooks on the control plane
By SSHing into nodes and running kubectl commands manually
By uploading YAML files directly through the cloud provider console

Correct answer: By committing changes to a Git repository and letting an operator like Argo CD sync them

GitOps uses Git as the single source of truth; operators like Argo CD or Flux continuously reconcile cluster state with the desired state declared in Git, providing full auditability.

Question 32: How does continuing education relate to cloud infrastructure & deployment for CDP certified professionals?

It is required only for entry-level practitioners
It is only needed when changing employers
It ensures professionals stay current with evolving standards and best practices (Correct answer)
It is optional and rarely impacts practice quality

Correct answer: It ensures professionals stay current with evolving standards and best practices

Continuing education ensures CDP professionals stay current with evolving standards, technologies, and best practices in cloud infrastructure & deployment, maintaining competency throughout their careers.

Certified DevSecOps Professional (CDP)

The CDP by Practical DevSecOps validates hands-on skills in building secure CI/CD pipelines, integrating SAST/DAST/SCA security testing, container security, cloud infrastructure hardening, and security automation at enterprise scale.

Questions

35 min

Time Limit

80%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds