CDP DevSecOps Fundamentals 3

Question 1

What distinguishes Dynamic Application Security Testing (DAST) from Static Application Security Testing (SAST)?

Accepted Answer

DAST tests a running application while SAST analyzes source code without execution

Answer

SAST inspects source code or binaries without running the application, while DAST exercises a live application to find runtime vulnerabilities like injection flaws.

Question 2

Which practice best supports a 'security as code' approach in DevSecOps?

Accepted Answer

Storing security policies and controls in version-controlled configuration files

Answer

Security as code means defining policies, compliance rules, and security controls in version-controlled files so they can be reviewed, tested, and applied consistently through automation.

Question 3

In a DevSecOps model, who is primarily responsible for fixing a security vulnerability found in application code?

Accepted Answer

The developer who owns the code

Answer

DevSecOps places security responsibility on the developer closest to the code, enabling faster remediation rather than routing findings through a separate security team.

Question 4

What is the role of 'secrets management' in a DevSecOps pipeline?

Accepted Answer

Securely storing and injecting credentials at runtime rather than hardcoding them

Answer

Secrets management solutions (e.g., HashiCorp Vault, AWS Secrets Manager) store API keys, passwords, and certificates securely and inject them at runtime, preventing hardcoded credentials.

Question 5

Which term describes the practice of automatically rolling back a deployment when security or health checks fail post-deployment?

Accepted Answer

Continuous rollback

Answer

Continuous rollback (or automated rollback) reverts a deployment automatically when post-deployment checks detect failures, minimizing exposure time from bad releases.

(CDP) Certified DevSecOps Professional Practice Test

(CDP) Certified DevSecOps Professional Practice Test

CDP DevSecOps Fundamentals 3