Practice Test Geeks(DOL) DevOps Leader Practice Test
← All DOL Flashcard Decks

DOL Security and Compliance Flashcards

6 cards from real DOL practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 6 DOL Security and Compliance flashcards as text

  1. What is the purpose of a Software Bill of Materials (SBOM) in a DevOps security context?

    Answer: Providing an inventory of open-source and third-party components to identify vulnerable dependencies

    An SBOM gives organizations visibility into all software components so they can quickly identify exposure when new vulnerabilities are disclosed.

  2. Which principle of least privilege means in a DevOps pipeline context?

    Answer: Giving pipelines and service accounts only the minimum permissions required to perform their tasks

    Least privilege limits the blast radius of a compromise by ensuring pipelines and accounts can only access what they strictly need.

  3. A DevOps team discovers that secrets are being hardcoded in source code. What is the recommended corrective action?

    Answer: Move secrets to a secrets management vault and inject them at runtime

    Secrets management vaults (e.g., HashiCorp Vault, AWS Secrets Manager) store credentials securely and inject them at runtime, keeping secrets out of source control.

  4. What is dynamic application security testing (DAST) and when is it typically run in a DevSecOps pipeline?

    Answer: It tests a running application by simulating attacks, run against a deployed test environment

    DAST interacts with a live application to find runtime vulnerabilities, making it most effective when run against a deployed staging or test environment.

  5. How does immutable infrastructure improve security in a DevOps environment?

    Answer: It eliminates configuration drift by replacing servers rather than patching them, ensuring a known-good state

    Immutable infrastructure ensures every deployment starts from a vetted image, eliminating accumulated drift and unauthorized changes that could introduce vulnerabilities.

  6. Which compliance framework is most commonly referenced when DevOps teams handle US federal government workloads?

    Answer: FedRAMP

    FedRAMP (Federal Risk and Authorization Management Program) is the US government standard for cloud service security authorization.

How this page was made: written with AI tools and published by Nathan Beja, founder of Practice Test Geeks, who is responsible for its content. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

  1. devopsinstitute.com — Score validity · verified Oct 2026
  2. peoplecert.org — Test delivery, eligibility, fees, exam format, passing score, renewal, time limit · verified Oct 2026