CDP Practice Test

The Certified DevSecOps Professional (CDP) from Practical DevSecOps suits people who want to show they can build security into CI/CD pipelines. This page gives you free practice question sets by topic, a map of the official content areas, worked explanations, a study plan and answers to common questions about the exam.

CDP Exam at a Glance

What changed for CDP in 2026

• Oct 27, 2026: Exam fee changed to $899 (previously $899 (course + labs + 1 exam attempt)).^[3]
• Oct 27, 2026: Number of questions changed to 5 challenges (tasks) (previously 5 hands-on challenges (tasks)).^[1]
• Oct 27, 2026: Time limit changed to 6 hours (plus 24 hours for report submission) (previously 6 hours + 24 hours for the report).^[2]
• Oct 27, 2026: Score release changed to Certificate emailed within 72 hours (previously Pass/fail only; certificate emailed within 72 hours).^[1]
• Oct 27, 2026: Retake policy changed to Unlimited attempts, 15-day waiting period between exams (previously Unlimited retakes, 15-day gap).^[4]
• Oct 27, 2026: Validity changed to Lifetime (never expires) (previously Lifetime).^[2]
• Oct 27, 2026: Delivery changed to Fully online (previously Fully online, from anywhere).^[2]
• Oct 27, 2026: Eligibility changed to Basic Linux command knowledge and OWASP Top 10 concepts; no prior DevOps experience required (previously Basic Linux + OWASP Top 10 knowledge; no DevOps experience required).^[2]

What the CDP is and how it works

According to Practical DevSecOps, “The CDP exam is an online, task-oriented exam where you attempt to solve 5 challenges (tasks) in a span of 6 hours.”^[1]

The CDP is a hands-on certification from Practical DevSecOps. It covers secure SDLC and CI/CD work, including SCA, SAST, DAST and security as code. The exam is fully online and can be taken from home, an office or any other place you choose.

It is task-oriented rather than multiple choice. You attempt 5 challenges in a span of 6 hours, then you have a 24-hour window to complete and submit a report for evaluation. To earn the certification you need at least 80 points (80%). Passing candidates receive their certificate by email within 72 hours.

Exams are scheduled only on Fridays and Saturdays. The course fee listed on the official pricing page is $899. You can sit the exam whenever you like, up to 6 months from your lab end date.

For eligibility, the course asks only for basic Linux command knowledge and a working grasp of application security ideas such as the OWASP Top 10. No prior experience with Dev or DevOps tools is required.

If you do not pass, you can retry as many times as you want. Each additional attempt costs $100, and there must be at least 15 days between exams. The credential is for life, so no renewal is required.

Fees and rules can change, so check the official Practical DevSecOps pages before you book.

CDP content outline and where to practise each area

The content areas below are copied from the official CDP content outline published by Practical DevSecOps. The right-hand column shows which of our practice sets covers it.

Worked examples: how to reason through CDP questions

These are practice questions written for this site, not questions from the real exam. Each explanation shows why the right answer is right and why the others are wrong.

Example 1

Question: How should a CDP professional handle a situation where automation & scripting fundamentals protocols conflict with practical constraints?

1. Always ignore the protocols in favor of practicality
2. Document the conflict and seek guidance from appropriate authorities
3. Make a unilateral decision without consultation
4. Avoid addressing the conflict entirely

Answer: B. Document the conflict and seek guidance from appropriate authorities

Explanation:

The correct answer is to document the conflict and seek guidance from appropriate authorities. This keeps a record of why a protocol could not be followed and lets the people who own the rules decide on an exception or a change.

Always ignoring the protocols is wrong because it removes the controls without anyone agreeing to it. Making a unilateral decision without consultation is wrong because it leaves you personally carrying a risk that others should weigh. Avoiding the conflict entirely is wrong because the problem remains and usually grows.

The general rule: when a rule and reality collide, do not quietly bend the rule and do not hide the problem. Make it visible, write it down and let the right owner decide. Pipeline exceptions work the same way.

Example 2

Question: What is a common challenge professionals face when applying cloud infrastructure & deployment principles in Certified DevSecOps Professional?

1. Balancing theoretical knowledge with practical application
2. Having too much support from colleagues
3. Excessive simplicity of industry regulations
4. Lack of any professional development opportunities

Answer: A. Balancing theoretical knowledge with practical application

Explanation:

The correct answer is balancing theoretical knowledge with practical application. Training material describes clean cases, while real cloud environments have legacy settings, odd dependencies and time pressure that a diagram does not show.

Having too much support from colleagues is not a challenge people normally report, so it fails as a realistic problem. Excessive simplicity of industry regulations is wrong because regulations are usually seen as hard to interpret, not too easy. A lack of any professional development opportunities is an absolute claim that rarely holds true.

The general rule: be wary of options with extreme wording such as excessive or any. The realistic answer usually names a tension between what you know and what a live system lets you do.

Example 3

Question: Which technology trend is most likely to impact automation & scripting fundamentals in the CDP field in coming years?

1. Complete elimination of human professionals
2. Digital tools for enhanced data collection, analysis, and reporting
3. Return to exclusively paper-based systems
4. Reduction in the need for professional certification

Answer: B. Digital tools for enhanced data collection, analysis, and reporting

Explanation:

The correct answer is digital tools for enhanced data collection, analysis and reporting. Automation extends what professionals can see and act on, which is the direction scripting and tooling have been moving.

Complete elimination of human professionals is wrong because judgement, review and accountability still need people. A return to exclusively paper-based systems is wrong because it runs against the whole trend towards automation. A reduction in the need for professional certification is wrong because nothing in better tooling removes the need to show skill.

The general rule: trend questions reward the answer that describes tools augmenting people. Options that say everything disappears or goes backwards are almost always distractors.

How to use these practice tests

Start with the official outline from Practical DevSecOps and read through the content areas listed in the table above. Mark the ones where you could not explain the idea to a colleague without looking it up.

Take the DevSecOps Fundamentals set to find gaps in vocabulary. Then work through the sets that match your weak areas, one topic at a time. After each set, read every explanation, including those for questions you got right, and write a short note on the rule behind each miss.

Remember that the real exam is hands-on. Question sets help you recall concepts, but they cannot replace practice in a lab. Use the course labs to run SAST, SCA and DAST tools against a sample application, read the output and decide what you would fix. Practise writing up what you found and why, because the report is part of what gets evaluated.

Close to your exam date, repeat the sets where you made the most errors and check that your lab access is still active. Confirm the exam slot, the rules and the current fee on the official pages. Our questions are written by us and are not real exam questions, so treat them as revision aids, not a preview.

Sources & last verified

1. Practical DevSecOps — number of questions, passing score, score release (official source). “The CDP exam is an online, task-oriented exam where you attempt to solve 5 challenges (tasks) in a span of 6 hours.” Verified Oct 27, 2026 · source checked Oct 26, 2026.
2. Practical DevSecOps — time limit, validity, delivery, eligibility (official source). “The exam consists of 5 challenges to be solved within 6 hours, followed by a 24-hour window to complete and submit the report for evaluation.” Verified Oct 28, 2026 · source checked Oct 26, 2026.
3. Practical DevSecOps — exam fee (official source). “Covers DevSecOps basics, emphasizing secure SDLC and CI/CD with SCA, SAST, DAST, and Security as Code. USD 899” Verified Oct 28, 2026 · source checked Oct 28, 2026.
4. Practical DevSecOps — retake fee, retake policy, renewal, registration deadline (official source). “Yes, the retake fee for each additional attempt is USD 100” Verified Oct 27, 2026 · source checked Oct 26, 2026.

How we verify: editorial & fact-checking policy. Report an error: contact us.