Kostenlos · ohne Anmeldung · ohne Zeitlimit
Fertige Multiple-Choice-Übungsquizze, von Hand geprüft. Löse jedes Gratis-Quiz online — jede Antwort kommt mit Erklärung, und jede Quiz-Seite hat einen vollständigen Lösungsschlüssel zum Wiederholen.
IT
Evaluate your understanding of shifting security left, Software Bill of Materials (SBOM), container scanning, and secure pipelines. Beantworte jede Frage und sieh sofort, ob du richtig liegst — jedes Mal mit Erklärung.
Ein kostenloser Multiple-Choice-Übungstest mit 16 Fragen zu IT. Jede Frage hat eine richtige Antwort und eine kurze Erklärung, und der vollständige Lösungsschlüssel unter dem Quiz dient zugleich als Lernzettel. Kein Konto, kein Zeitlimit — löse ihn so oft du willst.
Dies ist ein kostenloses Multiple-Choice-Quiz mit 16 Fragen. Nach jeder Antwort siehst du, ob sie richtig war — immer mit Erklärung. Keine Anmeldung, kein Zeitlimit: Mach es so oft du willst und nutze den Lösungsschlüssel oben zum Wiederholen, vorher oder nachher.
Richtige Antwort: BSAST analyzes source code or bytecodes without executing the application; DAST tests the running application from the outside without source code access
SAST analyzes static source code or binaries for vulnerabilities during development/builds; DAST tests running applications from the outside to find exploitable runtime vulnerabilities.
Richtige Antwort: BA machine-readable inventory of all software components, dependencies, libraries, and metadata that comprise an application
An SBOM (e.g., CycloneDX, SPDX) is an inventory listing every component, direct and transitive library, and license in a software build, essential for supply-chain risk management.
Richtige Antwort: BBy cross-referencing open-source project dependencies and versions against public vulnerability databases (like CVEs and NVD)
SCA scans dependency manifests (e.g., pom.xml, package.json) to match third-party and transitive libraries against known vulnerability databases like the National Vulnerability Database (NVD).
Richtige Antwort: BTo verify image origin and integrity in production, ensuring only trusted, unaltered pipeline builds run
Cosign signs container images within CI/CD pipelines; admission controllers verify these signatures before letting pods launch, guaranteeing images were built by approved pipelines.
Richtige Antwort: BAn attacker registers a malicious package with the same name as an internal private library on a public package registry (e.g., npm, PyPI) to trick builds
Dependency Confusion exploits package managers configured to check both public and private repositories, tricking them into downloading an attacker's higher-versioned public package of the same name.
Richtige Antwort: AA set of incremental guidelines and security standards to prevent tampering and ensure software supply chain integrity
SLSA is a security framework that defines levels of supply chain integrity, verifying source code origins, build process isolation, and artifact provenance.
Richtige Antwort: BThe secrets become permanently embedded inside the image layer metadata, visible to anyone with pull access
Every Dockerfile layer is cached and inspectable; baking secrets in via RUN or ENV stores them permanently in the image history, exposing them to anyone who pulls the image.
Richtige Antwort: BIt eliminates the need to store long-lived cloud credentials and static secrets inside CI/CD settings
OIDC federation allows CI/CD runners to exchange short-lived OIDC tokens for temporary cloud access roles, eliminating the risk of leaked long-lived cloud access keys.
Richtige Antwort: AAnalyzing text files to detect leaked tokens, private keys, and passwords using pattern and entropy checks
Secret scanning uses regex and entropy analysis to detect accidentally committed API keys, private certificates, and credentials before or as they are pushed to repositories.
Richtige Antwort: AEmploying software agents inside a running application during automated testing to identify vulnerabilities from within the runtime
IAST instruments the application runtime during functional or automated test runs, combining insights from code execution and runtime context to detect vulnerabilities accurately.
Richtige Antwort: AServers are never patched or modified in-place; all updates require building, deploying, and validating entirely new server images
Immutable infrastructure mandates that servers and containers are never modified in-place; updates require deploying freshly built, validated images to prevent configuration drift.
Richtige Antwort: BTo enforce custom admission policies (like disallowing privileged containers or enforcing resource limits) before resources are scheduled
Gatekeeper acts as a validating webhook using OPA's Rego policy engine, enforcing cluster governance policies (e.g., blocking root containers or enforcing label standards).
Richtige Antwort: BBuilds become non-reproducible, and unauthorized upstream image updates can introduce vulnerabilities or malicious changes silently
Dynamic tags like ':latest' change unpredictably; an upstream update can silently introduce vulnerabilities, break reproducibility, or pull compromised images.
Richtige Antwort: BRequiring mandatory peer reviews, passing CI checks, and blocking direct forced pushes to production branches
Branch protection rules enforce quality and security gates on critical branches (e.g., main), requiring signed commits, peer approvals, and passing CI scans before merges.
Richtige Antwort: BIntegrating security practices, vulnerability scanning, and testing early in the software development lifecycle
'Shift Left' moves security checks, scanning, and testing earlier into the design and development phases, catching vulnerabilities when they are cheaper and easier to fix.
Richtige Antwort: BAn isolated build that runs without outbound network access, relying exclusively on declared, verified dependencies for reproducibility
Hermetic builds isolate the build environment entirely from network access, ensuring output artifacts are deterministic, fully reproducible, and immune to dynamic upstream tampering.