Mixed Deck — All CDP Topics Flashcards

Image scanning in a container registry is used to:

Answer: Detect known CVEs in OS packages and application libraries within the image

Registry-integrated scanners check image layers against vulnerability databases and block or alert on images that exceed policy thresholds.

Which metric measures how long an attacker remains in an environment before detection, directly reflecting monitoring program gaps?

Answer: Dwell time (Mean Time to Detect)

Dwell time—the attacker's undetected presence duration—is the direct measure of how large the monitoring blind spots are.

Security regression testing in CI/CD is intended to:

Answer: Verify that previously fixed vulnerabilities have not been reintroduced

Regression tests for security ensure that code changes do not accidentally reopen vulnerabilities that were previously remediated.

Which logging standard helps ensure log integrity and non-repudiation in an incident investigation?

Answer: Forwarding logs to an immutable, centralized, write-once storage system in real time

Immutable, write-once centralized log storage prevents attackers from covering tracks and preserves admissible forensic evidence.

During incident eradication, a team discovers a backdoor in a production Docker image. What is the correct remediation sequence?

Answer: Rebuild the image from a clean base in the pipeline, redeploy, and invalidate all compromised image tags

Backdoored images must be rebuilt from clean sources through the trusted pipeline; patching in place leaves the supply chain compromised.

What is the primary output of the PASTA (Process for Attack Simulation and Threat Analysis) threat modeling methodology?

Answer: A prioritized list of threats aligned with business impact and risk

PASTA is a risk-centric, seven-stage methodology that produces a threat analysis aligned with business objectives and the organization's risk appetite.

What role does security policy play in DevSecOps?

Answer: Provide guidelines for managing risks and ensuring compliance

Security policies are fundamental in DevSecOps as they establish the foundational rules and principles for integrating security into every stage of the development pipeline. They provide clear guidelines for teams on how to manage risks, implement security controls, and handle sensitive data. This ensures that all development and operational activities align with organizational security objectives and regulatory compliance requirements, fostering a consistent and secure environment.

Which documentation practice is most important for cloud infrastructure & deployment in the CDP field?

Answer: Maintaining complete, accurate, and timely records

Maintaining complete, accurate, and timely records is crucial for accountability, quality assurance, and legal compliance in cloud infrastructure & deployment.

An admission controller in Kubernetes is best described as:

Answer: A webhook that intercepts and validates or mutates API requests before they are persisted

Admission controllers enforce security policies (e.g., blocking privileged containers) at the API server level before objects are created or modified.

Which SIEM capability allows security analysts to correlate events from multiple sources to detect complex attack patterns?

Answer: Event correlation rules

Event correlation rules in a SIEM link related events across sources to identify multi-step attack patterns that individual alerts would miss.

Which threat modeling approach uses hierarchical tree structures to visually represent how an attacker might achieve a malicious goal?

Answer: Attack Tree Analysis

Attack Tree Analysis models threats as a tree where the root node represents an attacker's goal and branches represent different paths to achieve that goal.

Software Composition Analysis (SCA) is primarily used to:

Answer: Identify vulnerabilities in open-source and third-party dependencies

SCA scans project dependencies against vulnerability databases to flag known CVEs in open-source libraries.

What does CVE stand for in the context of vulnerability management?

Answer: Common Vulnerabilities and Exposures

CVE (Common Vulnerabilities and Exposures) is a standardized list of publicly known security vulnerabilities maintained by MITRE Corporation.

What is the role of configuration management in security automation?

Answer: Automating the setup, maintenance, and monitoring of system configurations

Configuration management in security automation involves using tools to define, deploy, and maintain system configurations in a consistent and secure manner. This ensures that all systems adhere to security baselines, preventing misconfigurations that could lead to vulnerabilities. Automation in this area helps enforce security policies across the infrastructure and provides a clear audit trail of changes.

Which documentation practice is most important for automation & scripting fundamentals in the CDP field?

Answer: Maintaining complete, accurate, and timely records

Maintaining complete, accurate, and timely records is crucial for accountability, quality assurance, and legal compliance in automation & scripting fundamentals.

What is risk management in the context of DevSecOps?

Answer: Identifying, assessing, and mitigating potential risks

In DevSecOps, risk management is a continuous process focused on proactively identifying potential security threats and vulnerabilities throughout the software delivery pipeline. It involves assessing the likelihood and impact of these risks and then implementing strategies to mitigate them. The goal is to reduce the overall risk exposure of applications and infrastructure, ensuring business continuity and data protection.

Which phase of the Secure SDLC is MOST critical for identifying security requirements before any code is written?

Answer: Requirements/Design

Security requirements must be defined during the Requirements/Design phase so that security controls are built in from the start rather than bolted on later.

What is a zero-day vulnerability?

Answer: A vulnerability that is unknown to the software vendor and has no available patch

A zero-day vulnerability is a security flaw unknown to the vendor, giving them zero days to prepare a fix before it can be exploited by attackers.

Which quality improvement method is most applicable to cloud infrastructure & deployment in Certified DevSecOps Professional?

Answer: Plan-Do-Check-Act (PDCA) continuous improvement cycle

The PDCA cycle is widely recognized as the most effective quality improvement method, allowing CDP professionals to systematically improve cloud infrastructure & deployment practices.

In Certified DevSecOps Professional, what role does security architecture & network defense play in ensuring client/stakeholder satisfaction?

Answer: It builds trust through demonstrated competence and consistency

Security Architecture & Network Defense builds trust through demonstrated competence and consistency, which directly contributes to stakeholder satisfaction and confidence in the CDP professional.