DevSecOps · CyberQuiz

Q1 Easy 10 pts

'Shift left' in DevSecOps means:

Deploy only to the left region Integrate security earlier in the development lifecycle Move racks left Shrink the team

Q2 Medium 15 pts

SAST analyzes:

The running app Source code without executing it Network traffic Hardware

Q3 Medium 15 pts

DAST tests a running app from the outside — it stands for Dynamic Application Security ____ .

Q4 Medium 15 pts

Where should API keys/secrets be stored?

Hard-coded in the repo In a secrets manager/vault, injected at runtime In a public bucket In client JS

Q5 Medium 15 pts

Managing infrastructure with declarative files (e.g. Terraform) is Infrastructure as ____ .

Q6 Medium 15 pts

SCA (Software Composition Analysis) focuses on:

Your own code style Known vulnerabilities & licenses in third-party/open-source dependencies Network scanning Password strength

Q7 Medium 15 pts

Trivy and Grype are used to:

Serve web pages Scan container images/dependencies for known CVEs Route traffic Crack hashes

Q8 Hard 20 pts

An SBOM is:

A build server A Software Bill of Materials listing all components in a build A secret store A firewall

Q9 Medium 15 pts

A secrets scanner (e.g. gitleaks) prevents:

Slow builds Committing credentials/keys into source control XSS DDoS

Q10 Hard 20 pts

'Policy as Code' (e.g. OPA/Rego) lets teams:

Write essays Define and enforce security/compliance rules programmatically Encrypt disks Scan ports

Q11 Medium 15 pts

A CI 'security gate' that fails the build on critical findings ensures:

Faster shipping regardless Vulnerable code doesn't progress without remediation/approval No testing More secrets

Q12 Medium 15 pts

Least privilege for CI/CD pipelines means:

Give pipelines admin everywhere Grant only the minimal, ideally short-lived credentials needed Share one root token Disable auth

Q13 Medium 15 pts

Container images should ideally run as:

Root A non-root user Multiple admins No user

Q14 Hard 20 pts

'Distroless'/minimal base images improve security by:

Adding more tools Reducing the attack surface (fewer packages/shells) Increasing size Disabling logging

Q15 Hard 20 pts

Image signing with cosign/Sigstore provides:

Faster pulls Verifiable integrity/provenance of container images Smaller images Free storage

Q16 Hard 20 pts

SLSA is a framework for:

Load testing Supply-chain integrity levels for build provenance Password policy Network segmentation

Q17 Medium 15 pts

Kubernetes RBAC controls:

Pod CPU only Who can perform which actions on cluster resources Image size Node temperature

Q18 Hard 20 pts

A Kubernetes NetworkPolicy is used to:

Encrypt etcd Restrict pod-to-pod/network traffic (micro-segmentation) Sign images Scale nodes

Q19 Hard 20 pts

An admission controller (e.g. OPA Gatekeeper/Kyverno) can:

Speed DNS Reject non-compliant workloads at deploy time Crack hashes Route packets

Q20 Hard 20 pts

A 'container escape' is dangerous because it lets an attacker:

Resize the terminal Break out of the container to the host Change fonts Clear logs only

Q21 Medium 15 pts

Immutable infrastructure means:

Patching servers in place forever Replacing servers with new images instead of modifying them Never deploying Manual config drift

Q22 Medium 15 pts

Branch protection + required reviews help by:

Slowing everyone Ensuring code is reviewed and checks pass before merge Removing tests Sharing secrets

Q23 Hard 20 pts

Signed commits provide:

Faster git Assurance of who authored a commit (integrity/authenticity) Smaller repos Auto-merging

Q24 Medium 15 pts

IaC scanning (Checkov/tfsec) catches:

Slow terraform Insecure infrastructure config (open security groups, public buckets) before deploy UI bugs Font issues

Q25 Hard 20 pts

IAST combines aspects of:

Only SAST SAST and DAST via instrumentation during runtime testing Only SCA Firewalls

Q26 Hard 20 pts

Ephemeral CI credentials (e.g. OIDC to cloud) are safer than long-lived keys because:

They never expire They're short-lived and scoped, reducing leak impact They're printed to logs They're shared

Q27 Hard 20 pts

DORA metrics measure:

Security bugs only Software delivery performance (deploy frequency, lead time, MTTR, change fail rate) CPU usage Password strength

Q28 Medium 15 pts

A 'canary' deployment:

Ships to everyone at once Releases to a small subset first to limit risk Never releases Rolls back always

Q29 Medium 15 pts

Pinning dependency versions (lockfiles) helps prevent:

Faster installs Unexpected/malicious updates and improves reproducibility Disk usage Logging

Q30 Hard 20 pts

A dependency 'typosquatting' attack relies on:

Slow networks Malicious packages named similarly to popular ones Weak passwords Open ports

Q31 Easy 10 pts

Pre-commit hooks are useful to:

Deploy code Run quick checks (lint, secret scan) before code is committed Encrypt commits Merge branches

Q32 Hard 20 pts

Storing Terraform state securely matters because it can contain:

Only comments Sensitive values/secrets in plaintext Nothing useful UI assets

Q33 Medium 15 pts

A private artifact registry helps by:

Making builds public Controlling and scanning the artifacts/images you deploy Removing versioning Sharing keys

Q34 Medium 15 pts

'Fail the build' on secret detection means:

Ignore the secret Stop the pipeline so leaked credentials aren't shipped Email the secret Log it publicly

Q35 Medium 15 pts

License compliance scanning matters to avoid:

Faster code Legal risk from incompatible open-source licenses Better UI More CVEs

Q36 Hard 20 pts

Runtime security tools (e.g. Falco) detect:

Compile errors Suspicious behavior in running containers/hosts Font issues DNS latency

Q37 Medium 15 pts

A 'golden image' is:

A random build A hardened, approved base image reused across deployments A public bucket A secret key

Q38 Hard 20 pts

Why scan images at BUILD and again in the REGISTRY/runtime?

To waste compute New CVEs are disclosed over time; a once-clean image can become vulnerable Images never change risk To slow deploys

Q39 Medium 15 pts

The 'principle of least privilege' applied to a service account means:

Grant cluster-admin Grant only the specific permissions the workload needs Share one account No permissions ever

Q40 Medium 15 pts

GitOps improves security by:

Manual server edits Declaring desired state in Git with auditable, reviewed changes Disabling reviews Hiding history

Q41 Medium 15 pts

A 'threat model' in the pipeline helps decide:

The logo color Where to add security controls/tests based on realistic risks The build time The repo name

Q42 Hard 20 pts

Signing and verifying artifacts throughout the pipeline defends against:

Slow builds Supply-chain tampering (swapped/poisoned artifacts) UI bugs High latency

Q43 Hard 20 pts

Ephemeral build environments (fresh runners) reduce risk of:

Faster networks Persistent compromise/contamination between builds More storage Better UI

Q44 Medium 15 pts

SAST false positives are best handled by:

Disabling SAST Triage, tuning rules and suppressing verified non-issues Ignoring all findings Shipping anyway

Q45 Medium 15 pts

Container images should be rebuilt regularly to:

Change the tag only Pick up patched base layers and dependency fixes Increase size Remove logging

Q46 Easy 10 pts

A key DevSecOps culture principle is:

Security blocks everyone at the end Shared responsibility with automation embedded in the workflow Ignore developers Manual gates only

Q47 Medium 15 pts

Scanning pull requests (not just main) helps by:

Slowing merges only Catching vulnerabilities before they merge Hiding results Removing tests

Q48 Medium 15 pts

Rotating leaked secrets is necessary because:

They auto-expire Once exposed (even briefly), a secret must be considered compromised Logs delete them Git ignores them

Q49 Medium 15 pts

Observability (logs/metrics/traces) supports security by:

Encrypting nothing Enabling detection of and response to anomalies in production Slowing apps Removing alerts

Q50 Easy 10 pts

The overall goal of DevSecOps is to:

Slow delivery Deliver software quickly AND securely by automating security Remove testing Centralize all risk in one team