CDP DevSecOps Fundamentals 3 — Questions and Answers
Question 1: What distinguishes Dynamic Application Security Testing (DAST) from Static Application Security Testing (SAST)?
- DAST analyzes source code while SAST tests running applications
- DAST tests a running application while SAST analyzes source code without execution (Correct answer)
- DAST is manual while SAST is automated
- DAST requires source code access while SAST does not
Correct answer: DAST tests a running application while SAST analyzes source code without execution
SAST inspects source code or binaries without running the application, while DAST exercises a live application to find runtime vulnerabilities like injection flaws.
Question 2: Which practice best supports a 'security as code' approach in DevSecOps?
- Having a dedicated security team review each release manually
- Storing security policies and controls in version-controlled configuration files (Correct answer)
- Using spreadsheets to track vulnerability findings
- Requiring developers to attend annual security training
Correct answer: Storing security policies and controls in version-controlled configuration files
Security as code means defining policies, compliance rules, and security controls in version-controlled files so they can be reviewed, tested, and applied consistently through automation.
Question 3: In a DevSecOps model, who is primarily responsible for fixing a security vulnerability found in application code?
- The security operations center (SOC)
- The developer who owns the code (Correct answer)
- An external penetration tester
- The compliance officer
Correct answer: The developer who owns the code
DevSecOps places security responsibility on the developer closest to the code, enabling faster remediation rather than routing findings through a separate security team.
Question 4: What is the role of 'secrets management' in a DevSecOps pipeline?
- Encrypting all network traffic between services
- Securely storing and injecting credentials at runtime rather than hardcoding them (Correct answer)
- Managing role-based access control for CI/CD tools
- Obfuscating source code before distribution
Correct answer: Securely storing and injecting credentials at runtime rather than hardcoding them
Secrets management solutions (e.g., HashiCorp Vault, AWS Secrets Manager) store API keys, passwords, and certificates securely and inject them at runtime, preventing hardcoded credentials.
Question 5: Which term describes the practice of automatically rolling back a deployment when security or health checks fail post-deployment?
- Blue-green deployment
- Continuous rollback (Correct answer)
- Automated remediation
- Canary analysis
Correct answer: Continuous rollback
Continuous rollback (or automated rollback) reverts a deployment automatically when post-deployment checks detect failures, minimizing exposure time from bad releases.
Question 6: What is 'fuzzing' and how is it used in DevSecOps?
- Obfuscating code to prevent reverse engineering
- Sending random or malformed input to an application to discover crashes and vulnerabilities (Correct answer)
- Encrypting data in transit using randomized keys
- Testing UI responsiveness with simulated network delays
Correct answer: Sending random or malformed input to an application to discover crashes and vulnerabilities
Fuzzing (fuzz testing) bombards an application with unexpected or random inputs to uncover crashes, memory leaks, and security vulnerabilities that structured tests might miss.
Question 7: Which framework aligns DevSecOps security activities to maturity levels to help organizations improve their security posture over time?
- NIST Cybersecurity Framework
- OWASP Software Assurance Maturity Model (SAMM) (Correct answer)
- CIS Benchmarks
- ISO 27001
Correct answer: OWASP Software Assurance Maturity Model (SAMM)
OWASP SAMM provides a maturity model specifically designed to assess and improve software security practices across the SDLC, making it directly applicable to DevSecOps programs.
CDP DevSecOps Fundamentals 3
What distinguishes Dynamic Application Security Testing (DAST) from Static Application Security Testing (SAST)?