DOL Security and Compliance Flashcards

What is a key benefit of using policy-as-code tools like Open Policy Agent (OPA) in a DevOps pipeline?

Answer: Enforcing security and compliance policies consistently and automatically across all pipeline stages

Policy-as-code tools enforce governance rules automatically in the pipeline, ensuring consistent compliance without manual intervention.

A DevOps Leader wants to reduce mean time to detect (MTTD) security incidents. Which practice most directly supports this?

Answer: Implementing centralized logging and security information and event management (SIEM) with real-time alerting

Centralized logging with SIEM enables real-time correlation and alerting on security events, dramatically reducing the time to detect breaches.

What does 'zero trust' mean in the context of a DevOps network architecture?

Answer: Assuming no user or service is trusted by default and verifying every request regardless of network location

Zero trust eliminates implicit trust based on network location and requires explicit verification for every request, reducing lateral movement risk.

Which approach best supports audit trail requirements in a DevOps environment?

Answer: Using immutable, centralized audit logs with access controls and retention policies

Centralized, immutable audit logs with retention policies satisfy regulatory requirements and provide reliable evidence of all system and user actions.

How should a DevOps Leader foster a security-aware culture within development teams?

Answer: Embedding security champions within development teams and providing regular security training

Security champions embedded in teams create distributed ownership of security, while regular training keeps developers current on threats and best practices.

What is the primary purpose of conducting regular penetration tests in a DevSecOps program?

Answer: Simulating real-world attacks to validate that security controls are effective and identify gaps

Penetration tests validate the effectiveness of existing controls by simulating adversarial behavior, revealing gaps that automated tools may miss.