stud
bud
Sign up
Log in
Home
Library
Explore
SAT
More
DevSecOps Microcertification Flashcards | StudBud
Explore
/
DevSecOps Microcertification
DevSecOps Microcertification
50 terms
·
StudBud Administration
·
29 plays
Imported from external platform
Flashcards
50 cards
F
Practice quiz
P
Host live
L
Questions
50
Answers
1
What role do security champions play in a DevSecOps team?
They replace the security team
They focus only on compliance issues
They advocate for security best practices within their teams
They are solely responsible for security audits
2
What is the main focus of the DevSecOps culture?
Reducing the number of developers
Collaboration and shared responsibility
Isolating security from development
Increasing the complexity of security processes
3
Which tool is commonly used for dynamic application security testing (DAST)?
Nessus
Burp Suite
GitHub Actions
SonarQube
4
What is the principle of least privilege, and why is it important in security?
Users should have access to all resources for efficiency
All users should have administrative privileges
Privileges should be granted based on seniority
Users should have the minimum access necessary to perform their job
5
Which of the following is a key component of a DevSecOps strategy?
Continuous feedback loops
Isolated security teams
Delayed security testing
Manual security assessments only
6
Which tool is known for providing real-time threat intelligence?
Jenkins
GitLab
Splunk
ThreatConnect
7
What is the purpose of automated security testing in DevSecOps?
To ensure compliance with regulations only
To replace manual testing entirely
To identify vulnerabilities early and often
To slow down the development process
8
What is the purpose of a security incident response plan in a DevSecOps environment?
To manage project timelines
To outline how to develop software
To define how to respond to security incidents effectively
To focus on performance optimization
9
Which of the following practices helps in maintaining security in a CI/CD pipeline?
Ignoring security during development
Delaying security testing until deployment
Manual code reviews
Automated security checks
10
In the context of DevSecOps, what does "shift right" refer to?
Focusing only on pre-deployment security
Ignoring security in the development phase
Integrating security practices into production and post-deployment
Moving security practices to the end of the development process
11
In DevSecOps, what does "infrastructure as code" (IaC) refer to?
Writing code for security policies
Using physical servers only
Manual configuration of servers
Managing infrastructure through code and automation
12
Which of the following is a key principle of DevSecOps?
Security should be integrated into every phase of development
Developers should not worry about security
Security is only the responsibility of the operations team
Security is a one-time task
13
Which of the following is a common practice for securing APIs in a DevSecOps environment?
Hardcoding API keys in the source code
Implementing rate limiting and input validation
Using unsecured endpoints
Ignoring authentication and authorization
14
What is the primary purpose of using a Security Information and Event Management (SIEM) tool?
To manage source code
To analyze security alerts generated by applications and network hardware
To automate deployment processes
To perform static code analysis
15
What is the primary function of a data loss prevention (DLP) solution?
To improve data access speed
To prevent unauthorized data transfers and leaks
To facilitate data sharing
To reduce storage costs
16
In DevSecOps, what is the significance of container security?
Container security is only relevant in production
Containers can introduce new vulnerabilities that need to be managed
Containers eliminate the need for security measures
Containers are not a security concern
17
What is the main function of a Web Application Firewall (WAF)?
To filter and monitor HTTP traffic to and from a web application
To perform vulnerability scanning
To manage user access
To monitor network traffic
18
Which of the following tools is used for secret management?
Kubernetes
HashiCorp Vault
Jenkins
Docker
19
What is the primary benefit of integrating security tools into the CI/CD pipeline?
To eliminate the need for manual testing
To focus solely on compliance
To increase the speed of development
To automate security checks and reduce human error
20
Which of the following tools is commonly used for vulnerability scanning in DevSecOps?
OWASP ZAP
Kubernetes
Terraform
Ansible
21
In the context of secure coding practices, what does "input validation" primarily aim to prevent?
Unauthorized access to the system
Injection attacks, such as SQL injection
Performance issues
Code duplication
22
What is a common challenge when implementing DevSecOps?
Resistance to change in organizational culture
Lack of tools available
Too many security experts
Overly simplified processes
23
Which of the following best describes the "shift left" approach in DevSecOps?
Moving security practices to the end of the development process
Integrating security earlier in the development lifecycle
Shifting responsibilities from developers to security teams
Focusing only on operational security
24
Which of the following tools is used for API security testing?
Postman
OWASP ZAP
SoapUI
Swagger
25
Which of the following is a common practice for managing secrets in a DevSecOps pipeline?
Using environment variables
Hardcoding secrets in the source code
Storing secrets in plaintext files
Utilizing secret management tools like HashiCorp Vault
26
What is the purpose of a security baseline in a DevSecOps context?
To delay security assessments
To ignore security standards
To define the minimum security requirements for systems
To focus solely on performance metrics
27
What is the purpose of threat modeling in DevSecOps?
To create user stories
To focus on performance issues
To manage project timelines
To identify potential security threats and vulnerabilities early
28
What is the main purpose of using a tool like OWASP ZAP?
To monitor network traffic
To conduct dynamic security testing on web applications
To manage infrastructure as code
To perform static code analysis
29
What is the role of continuous monitoring in DevSecOps?
To ensure ongoing security assessments and compliance
To replace manual testing completely
To monitor only production environments
To focus solely on performance metrics
30
What is a common tool used in DevSecOps for automated security testing?
Git
SonarQube
Jenkins
Docker
31
Which of the following is a key practice in DevSecOps?
Delayed security assessments
Isolated development environments
Manual security audits
Continuous integration and continuous deployment (CI/CD)
32
What does DevSecOps stand for?
Development, Software, and Operations
Development, Security, and Operations
Development, System, and Operations
Development, Security, and Optimization
33
What is the primary goal of DevSecOps?
To improve collaboration between developers and security teams
To eliminate the need for security testing
To ensure security is integrated into the development process
To focus solely on operational efficiency
34
What is the primary function of a vulnerability scanner like Nessus?
To perform code reviews
To automate deployment processes
To manage user permissions
To identify vulnerabilities in systems and applications
35
What is the primary use of a tool like Snyk?
To scan for vulnerabilities in open-source dependencies
To monitor network traffic
To perform manual code reviews
To manage CI/CD pipelines
36
What is the significance of using a vulnerability management program in DevSecOps?
To ignore vulnerabilities until deployment
To focus solely on compliance
To identify and remediate vulnerabilities continuously
To delay security assessments
37
Which of the following tools is specifically designed for infrastructure as code (IaC) security?
Jenkins
GitHub Actions
SonarQube
Checkov
38
What is the primary purpose of using a tool like GitGuardian
To detect sensitive data leaks in source code
To manage CI/CD pipelines
To perform static code analysis
To monitor network traffic
39
In a DevSecOps approach, security is considered:
Only the responsibility of the security team
A separate phase in development
An afterthought
A shared responsibility throughout the development lifecycle
40
What is the purpose of compliance as code in a DevSecOps environment?
To delay compliance assessments
To automate compliance checks and ensure adherence to regulations
To focus solely on security
To ignore compliance requirements
41
What does the term "shift left" imply in the context of DevSecOps?
Shifting responsibilities from developers to security teams
Focusing only on operational security
Integrating security practices earlier in the development process
Moving security practices to the end of the development lifecycle
42
Which of the following is NOT a benefit of DevSecOps?
Increased collaboration among teams
Faster delivery of secure software
Higher costs due to additional security measures
Early detection of security issues
43
Which of the following tools is primarily used for penetration testing?
SonarQube
Veracode
Metasploit
Fortify
44
What is the primary purpose of using a tool like Aqua Security?
To provide security for containerized applications
To manage CI/CD pipelines
To monitor network traffic
To perform static code analysis
45
Which of the following is an example of a security tool that can be integrated into a CI/CD pipeline?
Gitleaks
Slack
Jenkins
GitHub
46
Which of the following tools is primarily used for static application security testing (SAST)?
Checkmarx
Veracode
Fortify
All of the above
47
What is the role of a security gate in a CI/CD pipeline?
To enforce security policies and checks before proceeding
To automatically approve all changes
To manage user access
To delay deployments for security checks
48
Which of the following tools is designed for container security?
Jenkins
Aqua Security
JFrog Artifactory
Terraform
49
Which of the following tools is often used for static application security testing (SAST)?
Nessus
Burp Suite
OWASP ZAP
SonarQube
50
Which of the following frameworks is commonly used for DevSecOps?
Agile
DevOps
Waterfall
NIST
