DOL Security and Compliance Flashcards

What is the primary goal of integrating security into the DevOps pipeline (DevSecOps)?

Answer: Shifting security left to detect vulnerabilities earlier in the development lifecycle

Shifting security left means embedding security checks early in the pipeline so vulnerabilities are found and fixed at lower cost.

Which practice best describes 'security as code' in a DevOps environment?

Answer: Storing security policies and configurations in version-controlled code repositories

Security as code means defining security policies, controls, and configurations in version-controlled scripts so they are auditable, repeatable, and automated.

A DevOps Leader wants to ensure compliance checks do not slow deployments. Which approach is most effective?

Answer: Automate compliance validation as a gate in the CI/CD pipeline

Automating compliance checks as pipeline gates ensures every release is validated without adding manual delay.

What does 'threat modeling' help a DevOps team accomplish?

Answer: Identifying potential security threats and mitigations early in the design phase

Threat modeling proactively identifies attack surfaces and vulnerabilities during design, reducing risk before code is written.

Which tool category is commonly used in DevSecOps pipelines to scan container images for known vulnerabilities?

Answer: Container image vulnerability scanners

Container image vulnerability scanners (e.g., Trivy, Clair) inspect images against CVE databases before they are deployed.

How should a DevOps Leader handle a situation where a security gate is blocking a critical hotfix deployment?

Answer: Use a documented, approved exception process with compensating controls and post-deployment remediation

A documented exception process with compensating controls allows critical fixes while maintaining accountability and ensuring the vulnerability is addressed promptly.