DevSecOps: Secure CI/CD & Supply Chain

Answer key & explanations

Every question in this quiz, with the correct answer marked and an explanation of why it is right. Use it to revise before or after taking the quiz above.

1. 1.What is the primary technical distinction between SAST (Static Application Security Testing) and DAST (Dynamic Application Security Testing)?

   • ASAST tests compiled machine code on production servers; DAST analyzes raw source code in Git
   • BSAST analyzes source code or bytecodes without executing the application; DAST tests the running application from the outside without source code access✓ Correct
   • CSAST can only detect network firewall misconfigurations; DAST only detects dependency vulnerabilities
   • DSAST is fully automated; DAST must always be performed manually by human penetration testers

   Correct answer: SAST analyzes source code or bytecodes without executing the application; DAST tests the running application from the outside without source code access

   SAST analyzes static source code or binaries for vulnerabilities during development/builds; DAST tests running applications from the outside to find exploitable runtime vulnerabilities.

2. 2.What is a Software Bill of Materials (SBOM)?

   • AAn invoice detailing monthly cloud hosting fees and expenses
   • BA machine-readable inventory of all software components, dependencies, libraries, and metadata that comprise an application✓ Correct
   • CA legally binding contract between software developers and end-users
   • DA collection of user stories and epics stored in Jira

   Correct answer: A machine-readable inventory of all software components, dependencies, libraries, and metadata that comprise an application

   An SBOM (e.g., CycloneDX, SPDX) is an inventory listing every component, direct and transitive library, and license in a software build, essential for supply-chain risk management.

3. 3.How does Software Composition Analysis (SCA) identify vulnerabilities in modern CI/CD pipelines?

   • ABy generating random inputs to crash running microservices
   • BBy cross-referencing open-source project dependencies and versions against public vulnerability databases (like CVEs and NVD)✓ Correct
   • CBy decompiling proprietary binary drivers into C source code
   • DBy monitoring live production traffic for SQL injection patterns

   Correct answer: By cross-referencing open-source project dependencies and versions against public vulnerability databases (like CVEs and NVD)

   SCA scans dependency manifests (e.g., pom.xml, package.json) to match third-party and transitive libraries against known vulnerability databases like the National Vulnerability Database (NVD).

4. 4.What is the purpose of cryptographically signing container images using tools like Sigstore Cosign?

   • ATo compress the container image layers to save disk space on worker nodes
   • BTo verify image origin and integrity in production, ensuring only trusted, unaltered pipeline builds run✓ Correct
   • CTo encrypt container image layers so that developers cannot view the code inside
   • DTo speed up image pulling times across multi-region Kubernetes clusters

   Correct answer: To verify image origin and integrity in production, ensuring only trusted, unaltered pipeline builds run

   Cosign signs container images within CI/CD pipelines; admission controllers verify these signatures before letting pods launch, guaranteeing images were built by approved pipelines.

5. 5.What is a Dependency Confusion attack in modern software development ecosystems?

   • AWhen a compiler links two different versions of the same shared C library
   • BAn attacker registers a malicious package with the same name as an internal private library on a public package registry (e.g., npm, PyPI) to trick builds✓ Correct
   • CWhen a developer forgets which dependencies are configured in pom.xml
   • DA network outage that prevents developers from downloading packages

   Correct answer: An attacker registers a malicious package with the same name as an internal private library on a public package registry (e.g., npm, PyPI) to trick builds

   Dependency Confusion exploits package managers configured to check both public and private repositories, tricking them into downloading an attacker's higher-versioned public package of the same name.

6. 6.What does the SLSA (Supply-chain Levels for Software Artifacts) framework provide?

   • AA set of incremental guidelines and security standards to prevent tampering and ensure software supply chain integrity✓ Correct
   • BAn open-source compiler for translating Python code into Rust
   • CA billing monitoring dashboard for cloud-native infrastructure
   • DA collection of penetration testing scripts for mobile applications

   Correct answer: A set of incremental guidelines and security standards to prevent tampering and ensure software supply chain integrity

   SLSA is a security framework that defines levels of supply chain integrity, verifying source code origins, build process isolation, and artifact provenance.

7. 7.What is the primary risk of baking secrets (like database credentials or API keys) directly into Dockerfile instructions?

   • AThe container will refuse to start on ARM64 processors
   • BThe secrets become permanently embedded inside the image layer metadata, visible to anyone with pull access✓ Correct
   • CThe Docker engine automatically uploads all embedded secrets to public GitHub repositories
   • DThe image layers fail to compress during storage operations

   Correct answer: The secrets become permanently embedded inside the image layer metadata, visible to anyone with pull access

   Every Dockerfile layer is cached and inspectable; baking secrets in via RUN or ENV stores them permanently in the image history, exposing them to anyone who pulls the image.

8. 8.How does an OIDC-based identity federation mechanism (such as GitHub Actions OIDC to AWS IAM) enhance pipeline security?

   • AIt increases download speeds for build dependencies
   • BIt eliminates the need to store long-lived cloud credentials and static secrets inside CI/CD settings✓ Correct
   • CIt encrypts all build logs stored on the CI runner
   • DIt converts standard shell scripts into compiled Go binaries

   Correct answer: It eliminates the need to store long-lived cloud credentials and static secrets inside CI/CD settings

   OIDC federation allows CI/CD runners to exchange short-lived OIDC tokens for temporary cloud access roles, eliminating the risk of leaked long-lived cloud access keys.

9. 9.What is Secret Scanning in version control platforms like GitLab or GitHub?

   • AAnalyzing text files to detect leaked tokens, private keys, and passwords using pattern and entropy checks✓ Correct
   • BScanning code to optimize database index performance
   • CChecking that user passwords meet minimum length requirements
   • DScanning pull requests for grammatically incorrect comments

   Correct answer: Analyzing text files to detect leaked tokens, private keys, and passwords using pattern and entropy checks

   Secret scanning uses regex and entropy analysis to detect accidentally committed API keys, private certificates, and credentials before or as they are pushed to repositories.

10. 10.What is the primary function of Interactive Application Security Testing (IAST)?

    • AEmploying software agents inside a running application during automated testing to identify vulnerabilities from within the runtime✓ Correct
    • BPairing a human security analyst with a developer during code reviews
    • CExecuting distributed denial-of-service simulations against pre-production servers
    • DTesting user interfaces for accessibility compliance

    Correct answer: Employing software agents inside a running application during automated testing to identify vulnerabilities from within the runtime

    IAST instruments the application runtime during functional or automated test runs, combining insights from code execution and runtime context to detect vulnerabilities accurately.

11. 11.What principle does the 'Immutable Infrastructure' pattern enforce in DevSecOps?

    • AServers are never patched or modified in-place; all updates require building, deploying, and validating entirely new server images✓ Correct
    • BSource code can never be edited once merged to the main branch
    • CDatabase records can never be updated or soft-deleted by applications
    • DOnly security team managers have permission to view production configurations

    Correct answer: Servers are never patched or modified in-place; all updates require building, deploying, and validating entirely new server images

    Immutable infrastructure mandates that servers and containers are never modified in-place; updates require deploying freshly built, validated images to prevent configuration drift.

12. 12.What is the function of an OPA (Open Policy Agent) Gatekeeper in a Kubernetes deployment pipeline?

    • ATo compile C++ source code inside container images
    • BTo enforce custom admission policies (like disallowing privileged containers or enforcing resource limits) before resources are scheduled✓ Correct
    • CTo route HTTP traffic based on path prefixes
    • DTo automatically renew SSL certificates issued by Let's Encrypt

    Correct answer: To enforce custom admission policies (like disallowing privileged containers or enforcing resource limits) before resources are scheduled

    Gatekeeper acts as a validating webhook using OPA's Rego policy engine, enforcing cluster governance policies (e.g., blocking root containers or enforcing label standards).

13. 13.What is the security danger of using unpinned, dynamic tags like ':latest' in container deployment manifests?

    • AImages with the ':latest' tag cannot be scheduled on Linux systems
    • BBuilds become non-reproducible, and unauthorized upstream image updates can introduce vulnerabilities or malicious changes silently✓ Correct
    • CKubernetes automatically deletes Pods using the ':latest' tag after sixty minutes
    • DContainer runtimes disable networking for images tagged as ':latest'

    Correct answer: Builds become non-reproducible, and unauthorized upstream image updates can introduce vulnerabilities or malicious changes silently

    Dynamic tags like ':latest' change unpredictably; an upstream update can silently introduce vulnerabilities, break reproducibility, or pull compromised images.

14. 14.What is Branch Protection in enterprise source control systems designed to enforce?

    • APreventing developers from checking out code onto mobile devices
    • BRequiring mandatory peer reviews, passing CI checks, and blocking direct forced pushes to production branches✓ Correct
    • CCompressing Git repositories when they exceed ten gigabytes
    • DEncrypting branch names using SHA-512 hashes

    Correct answer: Requiring mandatory peer reviews, passing CI checks, and blocking direct forced pushes to production branches

    Branch protection rules enforce quality and security gates on critical branches (e.g., main), requiring signed commits, peer approvals, and passing CI scans before merges.

15. 15.What is the concept of 'Shift Left' in modern DevSecOps?

    • AMigrating server infrastructure from East Coast data centers to West Coast cloud regions
    • BIntegrating security practices, vulnerability scanning, and testing early in the software development lifecycle✓ Correct
    • CShifting all application logic from backend servers to client frontend frameworks
    • DTransferring security accountability exclusively to junior developers

    Correct answer: Integrating security practices, vulnerability scanning, and testing early in the software development lifecycle

    'Shift Left' moves security checks, scanning, and testing earlier into the design and development phases, catching vulnerabilities when they are cheaper and easier to fix.

16. 16.What is Hermetic Build execution, and why is it important for software supply chain security?

    • AA build executed with high CPU priority on dedicated bare-metal hardware
    • BAn isolated build that runs without outbound network access, relying exclusively on declared, verified dependencies for reproducibility✓ Correct
    • CA build that writes its output files directly into encrypted zip archives
    • DA build that runs inside an isolated browser tab

    Correct answer: An isolated build that runs without outbound network access, relying exclusively on declared, verified dependencies for reproducibility

    Hermetic builds isolate the build environment entirely from network access, ensuring output artifacts are deterministic, fully reproducible, and immune to dynamic upstream tampering.

More free quizzes

• ITDistributed Systems: Consensus & Fault ToleranceDeep dive into distributed systems engineering, covering consensus protocols (Raft/Paxos), the CAP theorem, and vector clocks.16 questions
• ITLLM Engineering: Fine-Tuning, Alignment & ServingTest your knowledge of transformer architectures, PEFT techniques (LoRA), RLHF, vLLM, and production deployment strategies.16 questions
• ITApplied AI: Systems, Embeddings & RAGAssess your understanding of practical machine learning architectures, embedding spaces, and Retrieval-Augmented Generation systems.16 questions