DevOps Cloud & DevOps Practices 1 — Questions and Answers
Question 1: What does 'shift-left security' mean in a DevSecOps context?
- Integrating security testing and reviews earlier in the development lifecycle (Correct answer)
- Moving security controls from application code to network infrastructure
- Delegating security responsibilities to development teams instead of security teams
- Automating security patches on the left (staging) side of the pipeline
Correct answer: Integrating security testing and reviews earlier in the development lifecycle
Shift-left security embeds security tools (SAST, dependency scanning, secret detection) into CI/CD pipelines so vulnerabilities are found at commit time, not after deployment.
Question 2: What is AWS CodePipeline?
- A fully managed AWS CI/CD service that automates build, test, and deploy workflows (Correct answer)
- An AWS tool for defining infrastructure as code using YAML pipelines
- A managed Kubernetes service for running containerized applications
- An AWS service for monitoring pipeline execution metrics
Correct answer: A fully managed AWS CI/CD service that automates build, test, and deploy workflows
AWS CodePipeline is a managed continuous delivery service that automates release pipelines integrating with CodeBuild, CodeDeploy, and third-party tools.
Question 3: What is 'chaos engineering'?
- Deliberately injecting failures into systems to test resilience and uncover weaknesses (Correct answer)
- Running disorganized deployments to test team incident response
- Using random data to test application edge cases and error handling
- Simulating high traffic load to test system scalability
Correct answer: Deliberately injecting failures into systems to test resilience and uncover weaknesses
Chaos engineering proactively injects failures (network latency, instance termination, CPU spikes) in controlled experiments to identify weaknesses before they cause real outages.
Question 4: What is the '12-Factor App' methodology?
- A methodology for building scalable, maintainable cloud-native applications across 12 principles (Correct answer)
- A checklist of 12 security requirements for cloud applications
- A 12-step deployment process for containerized microservices
- A framework with 12 architectural patterns for distributed systems
Correct answer: A methodology for building scalable, maintainable cloud-native applications across 12 principles
The 12-Factor App methodology defines 12 principles for building SaaS applications that are scalable, portable, and maintainable, covering topics from codebase to logging.
Question 5: What is a 'feature flag' (feature toggle) in DevOps?
- A configuration switch that enables or disables features at runtime without deploying new code (Correct answer)
- A CI/CD pipeline flag that marks builds ready for production deployment
- A Git branch naming convention for feature development
- A Kubernetes label used to route traffic to specific Pod versions
Correct answer: A configuration switch that enables or disables features at runtime without deploying new code
Feature flags decouple code deployment from feature release, allowing teams to merge code to main, deploy it, and control when users see new features via configuration.
Question 6: What is 'DevSecOps'?
- The integration of security practices and tools throughout the DevOps pipeline (Correct answer)
- A team structure combining dedicated developers, security engineers, and operations staff
- A compliance framework for securing DevOps toolchains
- An approach to running security operations using DevOps methodologies
Correct answer: The integration of security practices and tools throughout the DevOps pipeline
DevSecOps integrates security as a shared responsibility throughout the entire software development and delivery lifecycle rather than treating it as a final gate.
DevOps Cloud & DevOps Practices 1
What does 'shift-left security' mean in a DevSecOps context?