CDP DevSecOps Fundamentals 2 — Questions and Answers
Question 1: Which principle best describes the DevSecOps concept of 'shifting left'?
- Deploying security controls only in production
- Integrating security early in the SDLC rather than at the end (Correct answer)
- Moving security responsibilities to the operations team
- Shifting security budget from tools to personnel
Correct answer: Integrating security early in the SDLC rather than at the end
Shifting left means introducing security activities (testing, scanning, reviews) earlier in the development lifecycle to catch issues when they are cheaper to fix.
Question 2: What is 'threat modeling' in the context of DevSecOps?
- Monitoring production traffic for anomalies
- Creating machine learning models to detect threats
- Systematically identifying potential threats and mitigations during design (Correct answer)
- Penetration testing performed by an external team
Correct answer: Systematically identifying potential threats and mitigations during design
Threat modeling is a structured process of identifying potential threats, attack vectors, and mitigations during the design phase of a system.
Question 3: Which of the following is an example of a 'security gate' in a CI/CD pipeline?
- A firewall rule blocking outbound traffic
- An automated check that fails the build when critical vulnerabilities are found (Correct answer)
- A manual approval step before deployment to staging
- A network ACL applied to the build server
Correct answer: An automated check that fails the build when critical vulnerabilities are found
A security gate is an automated policy enforcement point in the pipeline that blocks progression when defined security thresholds are breached.
Question 4: In DevSecOps, what does 'infrastructure as code' (IaC) security scanning help prevent?
- Runtime application errors in microservices
- Misconfigured cloud resources being deployed to production (Correct answer)
- Unauthorized access to the source code repository
- Data exfiltration through network sockets
Correct answer: Misconfigured cloud resources being deployed to production
IaC security scanning analyzes Terraform, CloudFormation, or similar templates before deployment to catch misconfigurations before they reach production.
Question 5: Which OWASP resource is most commonly integrated into DevSecOps pipelines to guide web application security testing?
- OWASP SAMM
- OWASP Top Ten (Correct answer)
- OWASP ASVS
- OWASP MASVS
Correct answer: OWASP Top Ten
The OWASP Top Ten is a widely referenced list of the most critical web application security risks and is commonly used to frame automated and manual testing efforts.
Question 6: What is the primary purpose of a Software Bill of Materials (SBOM) in DevSecOps?
- To document the cost of third-party software licenses
- To provide a formal inventory of components and dependencies in a software product (Correct answer)
- To authorize the use of open-source libraries by the legal team
- To track deployment frequency across environments
Correct answer: To provide a formal inventory of components and dependencies in a software product
An SBOM is a comprehensive inventory of all components, libraries, and dependencies in software, enabling rapid identification of affected systems when vulnerabilities are disclosed.
Question 7: Which metric is most useful for measuring the effectiveness of security integration in a DevSecOps pipeline?
- Number of developers on the team
- Mean Time to Remediate (MTTR) security vulnerabilities (Correct answer)
- Total lines of code scanned per day
- Number of firewall rules deployed
Correct answer: Mean Time to Remediate (MTTR) security vulnerabilities
MTTR for security vulnerabilities measures how quickly the team identifies and fixes issues, directly reflecting the effectiveness of security integration and response processes.
CDP DevSecOps Fundamentals 2
Which principle best describes the DevSecOps concept of 'shifting left'?