Continuous Monitoring & Incident Response Flashcards

Which approach best supports continuous compliance monitoring in a DevSecOps pipeline?

Answer: Policy-as-code with automated checks integrated into CI/CD gates

Policy-as-code encodes compliance rules as executable checks that run automatically in the pipeline, providing continuous rather than point-in-time compliance evidence.

A blue team detects lateral movement via stolen service account credentials in a cloud environment. Which containment action minimizes blast radius without causing full outage?

Answer: Revoke the service account's active sessions and rotate credentials while scoping IAM policies

Revoking active sessions and rotating credentials stops the attacker while minimizing disruption; blocking only the IP leaves the credential usable from other locations.

What is the purpose of a 'canary token' in a DevSecOps monitoring strategy?

Answer: A decoy credential or file that triggers an alert when accessed, indicating a breach

Canary tokens are fake credentials or files planted in sensitive locations; any access triggers an alert because only an attacker would find and use them.

Which logging standard helps ensure log integrity and non-repudiation in an incident investigation?

Answer: Forwarding logs to an immutable, centralized, write-once storage system in real time

Immutable, write-once centralized log storage prevents attackers from covering tracks and preserves admissible forensic evidence.

In a devsecops environment, what is 'chaos engineering' used for in the context of incident response readiness?

Answer: Deliberately injecting failures to test and improve system resilience and response procedures

Chaos engineering validates that monitoring detects failures and that incident response procedures work correctly before real outages occur.

Which Kubernetes-native tool provides runtime threat detection by monitoring kernel system calls for suspicious behavior inside containers?

Answer: Falco

Falco uses eBPF/kernel module hooks to watch system calls in real time and alert on behaviors like shell spawning in containers or sensitive file reads.

After a supply chain attack injects malicious code into a third-party library used across 40 microservices, which monitoring capability would have provided the earliest warning?

Answer: Software composition analysis (SCA) integrated into the build pipeline with hash verification

SCA with hash verification detects when a library's content has changed from its expected checksum, catching tampering at build time before deployment.