Za darmo · bez rejestracji · bez limitu czasu
Gotowe quizy z pytaniami zamkniętymi, sprawdzone ręcznie. Rozwiąż dowolny darmowy quiz online — każda odpowiedź ma wyjaśnienie, a każdy quiz pełny klucz odpowiedzi do powtórki.
Wczytywanie quizów
Za darmo · bez rejestracji · bez limitu czasu
Gotowe quizy z pytaniami zamkniętymi, sprawdzone ręcznie. Rozwiąż dowolny darmowy quiz online — każda odpowiedź ma wyjaśnienie, a każdy quiz pełny klucz odpowiedzi do powtórki.
IT
Evaluate your understanding of shifting security left, Software Bill of Materials (SBOM), container scanning, and secure pipelines. Odpowiadaj na pytania i od razu sprawdzaj, czy to dobra odpowiedź — zawsze z wyjaśnieniem.
Darmowy test próbny z 16 pytaniami zamkniętymi z kategorii IT. Każde pytanie ma jedną poprawną odpowiedź i krótkie wyjaśnienie, a pełny klucz odpowiedzi pod quizem służy jako ściąga do nauki. Bez konta, bez limitu czasu — rozwiązuj, ile chcesz.
To darmowy quiz z 16 pytaniami zamkniętymi. Po każdej odpowiedzi zobaczysz, czy była poprawna, razem z wyjaśnieniem. Bez rejestracji i bez limitu czasu — rozwiązuj go, ile razy chcesz, a klucz odpowiedzi powyżej wykorzystaj do powtórki przed quizem albo po nim.
Poprawna odpowiedź: BSAST analyzes source code or bytecodes without executing the application; DAST tests the running application from the outside without source code access
SAST analyzes static source code or binaries for vulnerabilities during development/builds; DAST tests running applications from the outside to find exploitable runtime vulnerabilities.
Poprawna odpowiedź: BA machine-readable inventory of all software components, dependencies, libraries, and metadata that comprise an application
An SBOM (e.g., CycloneDX, SPDX) is an inventory listing every component, direct and transitive library, and license in a software build, essential for supply-chain risk management.
Poprawna odpowiedź: BBy cross-referencing open-source project dependencies and versions against public vulnerability databases (like CVEs and NVD)
SCA scans dependency manifests (e.g., pom.xml, package.json) to match third-party and transitive libraries against known vulnerability databases like the National Vulnerability Database (NVD).
Poprawna odpowiedź: BTo verify image origin and integrity in production, ensuring only trusted, unaltered pipeline builds run
Cosign signs container images within CI/CD pipelines; admission controllers verify these signatures before letting pods launch, guaranteeing images were built by approved pipelines.
Poprawna odpowiedź: BAn attacker registers a malicious package with the same name as an internal private library on a public package registry (e.g., npm, PyPI) to trick builds
Dependency Confusion exploits package managers configured to check both public and private repositories, tricking them into downloading an attacker's higher-versioned public package of the same name.
Poprawna odpowiedź: AA set of incremental guidelines and security standards to prevent tampering and ensure software supply chain integrity
SLSA is a security framework that defines levels of supply chain integrity, verifying source code origins, build process isolation, and artifact provenance.
Poprawna odpowiedź: BThe secrets become permanently embedded inside the image layer metadata, visible to anyone with pull access
Every Dockerfile layer is cached and inspectable; baking secrets in via RUN or ENV stores them permanently in the image history, exposing them to anyone who pulls the image.
Poprawna odpowiedź: BIt eliminates the need to store long-lived cloud credentials and static secrets inside CI/CD settings
OIDC federation allows CI/CD runners to exchange short-lived OIDC tokens for temporary cloud access roles, eliminating the risk of leaked long-lived cloud access keys.
Poprawna odpowiedź: AAnalyzing text files to detect leaked tokens, private keys, and passwords using pattern and entropy checks
Secret scanning uses regex and entropy analysis to detect accidentally committed API keys, private certificates, and credentials before or as they are pushed to repositories.
Poprawna odpowiedź: AEmploying software agents inside a running application during automated testing to identify vulnerabilities from within the runtime
IAST instruments the application runtime during functional or automated test runs, combining insights from code execution and runtime context to detect vulnerabilities accurately.
Poprawna odpowiedź: AServers are never patched or modified in-place; all updates require building, deploying, and validating entirely new server images
Immutable infrastructure mandates that servers and containers are never modified in-place; updates require deploying freshly built, validated images to prevent configuration drift.
Poprawna odpowiedź: BTo enforce custom admission policies (like disallowing privileged containers or enforcing resource limits) before resources are scheduled
Gatekeeper acts as a validating webhook using OPA's Rego policy engine, enforcing cluster governance policies (e.g., blocking root containers or enforcing label standards).
Poprawna odpowiedź: BBuilds become non-reproducible, and unauthorized upstream image updates can introduce vulnerabilities or malicious changes silently
Dynamic tags like ':latest' change unpredictably; an upstream update can silently introduce vulnerabilities, break reproducibility, or pull compromised images.
Poprawna odpowiedź: BRequiring mandatory peer reviews, passing CI checks, and blocking direct forced pushes to production branches
Branch protection rules enforce quality and security gates on critical branches (e.g., main), requiring signed commits, peer approvals, and passing CI scans before merges.
Poprawna odpowiedź: BIntegrating security practices, vulnerability scanning, and testing early in the software development lifecycle
'Shift Left' moves security checks, scanning, and testing earlier into the design and development phases, catching vulnerabilities when they are cheaper and easier to fix.
Poprawna odpowiedź: BAn isolated build that runs without outbound network access, relying exclusively on declared, verified dependencies for reproducibility
Hermetic builds isolate the build environment entirely from network access, ensuring output artifacts are deterministic, fully reproducible, and immune to dynamic upstream tampering.