Free · no sign-up · no time limit
Ready-made multiple-choice practice quizzes, hand-checked. Take any free quiz online — every answer comes with an explanation, and every quiz page has a full answer key to revise from.
Loading quizzes
Free · no sign-up · no time limit
Ready-made multiple-choice practice quizzes, hand-checked. Take any free quiz online — every answer comes with an explanation, and every quiz page has a full answer key to revise from.
IT
Evaluate your understanding of shifting security left, Software Bill of Materials (SBOM), container scanning, and secure pipelines. Answer each question to see whether you got it right, with an explanation every time.
A free 16-question multiple-choice practice test on IT. Each question has one correct answer and a short explanation, and the full answer key below the player doubles as a study sheet. No account, no time limit — take it as often as you like.
This is a free, 16-question multiple-choice quiz. Answer each question to see whether you got it right, with an explanation for every answer. There is no sign-up and no time limit — take it as many times as you like, and use the answer key above to revise before or after.
Correct answer: BSAST analyzes source code or bytecodes without executing the application; DAST tests the running application from the outside without source code access
SAST analyzes static source code or binaries for vulnerabilities during development/builds; DAST tests running applications from the outside to find exploitable runtime vulnerabilities.
Correct answer: BA machine-readable inventory of all software components, dependencies, libraries, and metadata that comprise an application
An SBOM (e.g., CycloneDX, SPDX) is an inventory listing every component, direct and transitive library, and license in a software build, essential for supply-chain risk management.
Correct answer: BBy cross-referencing open-source project dependencies and versions against public vulnerability databases (like CVEs and NVD)
SCA scans dependency manifests (e.g., pom.xml, package.json) to match third-party and transitive libraries against known vulnerability databases like the National Vulnerability Database (NVD).
Correct answer: BTo verify image origin and integrity in production, ensuring only trusted, unaltered pipeline builds run
Cosign signs container images within CI/CD pipelines; admission controllers verify these signatures before letting pods launch, guaranteeing images were built by approved pipelines.
Correct answer: BAn attacker registers a malicious package with the same name as an internal private library on a public package registry (e.g., npm, PyPI) to trick builds
Dependency Confusion exploits package managers configured to check both public and private repositories, tricking them into downloading an attacker's higher-versioned public package of the same name.
Correct answer: AA set of incremental guidelines and security standards to prevent tampering and ensure software supply chain integrity
SLSA is a security framework that defines levels of supply chain integrity, verifying source code origins, build process isolation, and artifact provenance.
Correct answer: BThe secrets become permanently embedded inside the image layer metadata, visible to anyone with pull access
Every Dockerfile layer is cached and inspectable; baking secrets in via RUN or ENV stores them permanently in the image history, exposing them to anyone who pulls the image.
Correct answer: BIt eliminates the need to store long-lived cloud credentials and static secrets inside CI/CD settings
OIDC federation allows CI/CD runners to exchange short-lived OIDC tokens for temporary cloud access roles, eliminating the risk of leaked long-lived cloud access keys.
Correct answer: AAnalyzing text files to detect leaked tokens, private keys, and passwords using pattern and entropy checks
Secret scanning uses regex and entropy analysis to detect accidentally committed API keys, private certificates, and credentials before or as they are pushed to repositories.
Correct answer: AEmploying software agents inside a running application during automated testing to identify vulnerabilities from within the runtime
IAST instruments the application runtime during functional or automated test runs, combining insights from code execution and runtime context to detect vulnerabilities accurately.
Correct answer: AServers are never patched or modified in-place; all updates require building, deploying, and validating entirely new server images
Immutable infrastructure mandates that servers and containers are never modified in-place; updates require deploying freshly built, validated images to prevent configuration drift.
Correct answer: BTo enforce custom admission policies (like disallowing privileged containers or enforcing resource limits) before resources are scheduled
Gatekeeper acts as a validating webhook using OPA's Rego policy engine, enforcing cluster governance policies (e.g., blocking root containers or enforcing label standards).
Correct answer: BBuilds become non-reproducible, and unauthorized upstream image updates can introduce vulnerabilities or malicious changes silently
Dynamic tags like ':latest' change unpredictably; an upstream update can silently introduce vulnerabilities, break reproducibility, or pull compromised images.
Correct answer: BRequiring mandatory peer reviews, passing CI checks, and blocking direct forced pushes to production branches
Branch protection rules enforce quality and security gates on critical branches (e.g., main), requiring signed commits, peer approvals, and passing CI scans before merges.
Correct answer: BIntegrating security practices, vulnerability scanning, and testing early in the software development lifecycle
'Shift Left' moves security checks, scanning, and testing earlier into the design and development phases, catching vulnerabilities when they are cheaper and easier to fix.
Correct answer: BAn isolated build that runs without outbound network access, relying exclusively on declared, verified dependencies for reproducibility
Hermetic builds isolate the build environment entirely from network access, ensuring output artifacts are deterministic, fully reproducible, and immune to dynamic upstream tampering.