CDP Threat Modeling & Vulnerability Management 3

Question 1

What does 'shift-left' security mean in the context of DevSecOps?

Accepted Answer

Integrating security testing and practices earlier in the software development lifecycle

Answer

'Shift-left' refers to moving security practices earlier in the SDLC—integrating them during design and development rather than discovering issues post-deployment.

Question 2

What is Software Composition Analysis (SCA) primarily used for in DevSecOps vulnerability management?

Accepted Answer

Identifying vulnerabilities in third-party libraries and open-source dependencies

Answer

SCA tools inventory and scan project dependencies and open-source components to detect known vulnerabilities (CVEs), outdated packages, and license compliance issues.

Question 3

At which stage of a CI/CD pipeline should vulnerability scanning ideally first be integrated?

Accepted Answer

During code commit and pull request creation

Answer

Vulnerability scanning should begin at the code commit or pull request stage to detect issues as early as possible, when remediation is fastest and least expensive.

Question 4

What is the purpose of a Vulnerability Disclosure Policy (VDP)?

Accepted Answer

A formal process enabling external researchers to responsibly report vulnerabilities to an organization

Answer

A VDP establishes a formal, safe channel for external security researchers to report discovered vulnerabilities to an organization, enabling coordinated and responsible disclosure.

Question 5

What is the primary function of threat intelligence feeds in a vulnerability management program?

Accepted Answer

To provide real-time data about actively exploited vulnerabilities and emerging threats for prioritization

Answer

Threat intelligence feeds deliver actionable data on active exploits, threat actors, and emerging vulnerabilities, helping teams prioritize remediation based on real-world exploitation likelihood.

(CDP) Certified DevSecOps Professional Practice Test

(CDP) Certified DevSecOps Professional Practice Test

CDP Threat Modeling & Vulnerability Management 3