DOL DOL Security and Compliance 2 — Questions and Answers
Question 1: What is the purpose of a Software Bill of Materials (SBOM) in a DevOps security context?
- Tracking software licensing costs
- Providing an inventory of open-source and third-party components to identify vulnerable dependencies (Correct answer)
- Documenting sprint velocity
- Listing all cloud services used by an application
Correct answer: Providing an inventory of open-source and third-party components to identify vulnerable dependencies
An SBOM gives organizations visibility into all software components so they can quickly identify exposure when new vulnerabilities are disclosed.
Question 2: Which principle of least privilege means in a DevOps pipeline context?
- Granting every team member full admin access for efficiency
- Giving pipelines and service accounts only the minimum permissions required to perform their tasks (Correct answer)
- Rotating passwords every 90 days
- Using a single shared service account for all CI/CD jobs
Correct answer: Giving pipelines and service accounts only the minimum permissions required to perform their tasks
Least privilege limits the blast radius of a compromise by ensuring pipelines and accounts can only access what they strictly need.
Question 3: A DevOps team discovers that secrets are being hardcoded in source code. What is the recommended corrective action?
- Encrypt the source code repository
- Move secrets to a secrets management vault and inject them at runtime (Correct answer)
- Document the secrets in a secure spreadsheet
- Rotate secrets quarterly and update the code accordingly
Correct answer: Move secrets to a secrets management vault and inject them at runtime
Secrets management vaults (e.g., HashiCorp Vault, AWS Secrets Manager) store credentials securely and inject them at runtime, keeping secrets out of source control.
Question 4: What is dynamic application security testing (DAST) and when is it typically run in a DevSecOps pipeline?
- It analyzes source code without executing it, run before build
- It tests a running application by simulating attacks, run against a deployed test environment (Correct answer)
- It scans infrastructure configuration files at commit time
- It monitors application logs in production for anomalies
Correct answer: It tests a running application by simulating attacks, run against a deployed test environment
DAST interacts with a live application to find runtime vulnerabilities, making it most effective when run against a deployed staging or test environment.
Question 5: How does immutable infrastructure improve security in a DevOps environment?
- It prevents developers from writing insecure code
- It eliminates configuration drift by replacing servers rather than patching them, ensuring a known-good state (Correct answer)
- It encrypts all data at rest automatically
- It blocks unauthorized login attempts
Correct answer: It eliminates configuration drift by replacing servers rather than patching them, ensuring a known-good state
Immutable infrastructure ensures every deployment starts from a vetted image, eliminating accumulated drift and unauthorized changes that could introduce vulnerabilities.
Question 6: Which compliance framework is most commonly referenced when DevOps teams handle US federal government workloads?
- PCI DSS
- HIPAA
- FedRAMP (Correct answer)
- SOC 2
Correct answer: FedRAMP
FedRAMP (Federal Risk and Authorization Management Program) is the US government standard for cloud service security authorization.
DOL DOL Security and Compliance 2
What is the purpose of a Software Bill of Materials (SBOM) in a DevOps security context?