stud
bud
Sign up
Log in
Home
Library
Explore
SAT
More
DevSecOps Microcertification Flashcards | StudBud
Explore
/
DevSecOps Microcertification
DevSecOps Microcertification
50 terms
·
StudBud Administration
·
29 plays
Imported from external platform
Flashcards
50 cards
F
Practice quiz
P
Host live
L
Questions
50
Answers
1
Which of the following tools is primarily used for penetration testing?
Metasploit
Veracode
Fortify
SonarQube
2
In the context of DevSecOps, what does "shift right" refer to?
Integrating security practices into production and post-deployment
Moving security practices to the end of the development process
Ignoring security in the development phase
Focusing only on pre-deployment security
3
In the context of secure coding practices, what does "input validation" primarily aim to prevent?
Performance issues
Code duplication
Injection attacks, such as SQL injection
Unauthorized access to the system
4
What is the primary purpose of using a Security Information and Event Management (SIEM) tool?
To analyze security alerts generated by applications and network hardware
To automate deployment processes
To manage source code
To perform static code analysis
5
What is the purpose of threat modeling in DevSecOps?
To manage project timelines
To create user stories
To identify potential security threats and vulnerabilities early
To focus on performance issues
6
Which of the following is a key component of a DevSecOps strategy?
Continuous feedback loops
Delayed security testing
Manual security assessments only
Isolated security teams
7
Which of the following tools is designed for container security?
Terraform
JFrog Artifactory
Jenkins
Aqua Security
8
Which of the following frameworks is commonly used for DevSecOps?
Agile
DevOps
Waterfall
NIST
9
Which of the following practices helps in maintaining security in a CI/CD pipeline?
Delaying security testing until deployment
Manual code reviews
Automated security checks
Ignoring security during development
10
Which of the following is a key principle of DevSecOps?
Security is only the responsibility of the operations team
Developers should not worry about security
Security should be integrated into every phase of development
Security is a one-time task
11
What is the primary use of a tool like Snyk?
To manage CI/CD pipelines
To monitor network traffic
To perform manual code reviews
To scan for vulnerabilities in open-source dependencies
12
In DevSecOps, what does "infrastructure as code" (IaC) refer to?
Managing infrastructure through code and automation
Writing code for security policies
Manual configuration of servers
Using physical servers only
13
What is the role of a security gate in a CI/CD pipeline?
To automatically approve all changes
To enforce security policies and checks before proceeding
To delay deployments for security checks
To manage user access
14
What does the term "shift left" imply in the context of DevSecOps?
Shifting responsibilities from developers to security teams
Integrating security practices earlier in the development process
Moving security practices to the end of the development lifecycle
Focusing only on operational security
15
What role do security champions play in a DevSecOps team?
They are solely responsible for security audits
They advocate for security best practices within their teams
They focus only on compliance issues
They replace the security team
16
Which of the following is NOT a benefit of DevSecOps?
Faster delivery of secure software
Early detection of security issues
Increased collaboration among teams
Higher costs due to additional security measures
17
What is the purpose of compliance as code in a DevSecOps environment?
To ignore compliance requirements
To automate compliance checks and ensure adherence to regulations
To delay compliance assessments
To focus solely on security
18
Which of the following tools is commonly used for vulnerability scanning in DevSecOps?
Kubernetes
Ansible
OWASP ZAP
Terraform
19
What is a common tool used in DevSecOps for automated security testing?
Git
Docker
SonarQube
Jenkins
20
What is the main focus of the DevSecOps culture?
Increasing the complexity of security processes
Reducing the number of developers
Collaboration and shared responsibility
Isolating security from development
21
Which of the following tools is primarily used for static application security testing (SAST)?
Checkmarx
Fortify
Veracode
All of the above
22
What is the primary function of a data loss prevention (DLP) solution?
To prevent unauthorized data transfers and leaks
To facilitate data sharing
To improve data access speed
To reduce storage costs
23
Which of the following tools is often used for static application security testing (SAST)?
Nessus
OWASP ZAP
Burp Suite
SonarQube
24
Which of the following is a common practice for managing secrets in a DevSecOps pipeline?
Hardcoding secrets in the source code
Using environment variables
Storing secrets in plaintext files
Utilizing secret management tools like HashiCorp Vault
25
What is the principle of least privilege, and why is it important in security?
All users should have administrative privileges
Users should have access to all resources for efficiency
Users should have the minimum access necessary to perform their job
Privileges should be granted based on seniority
26
What is the primary benefit of integrating security tools into the CI/CD pipeline?
To increase the speed of development
To focus solely on compliance
To automate security checks and reduce human error
To eliminate the need for manual testing
27
What is the significance of using a vulnerability management program in DevSecOps?
To delay security assessments
To focus solely on compliance
To identify and remediate vulnerabilities continuously
To ignore vulnerabilities until deployment
28
What is the primary purpose of using a tool like Aqua Security?
To perform static code analysis
To provide security for containerized applications
To monitor network traffic
To manage CI/CD pipelines
29
What is the primary purpose of using a tool like GitGuardian
To manage CI/CD pipelines
To perform static code analysis
To detect sensitive data leaks in source code
To monitor network traffic
30
Which of the following tools is used for secret management?
Kubernetes
Docker
HashiCorp Vault
Jenkins
31
Which of the following best describes the "shift left" approach in DevSecOps?
Shifting responsibilities from developers to security teams
Integrating security earlier in the development lifecycle
Focusing only on operational security
Moving security practices to the end of the development process
32
Which tool is commonly used for dynamic application security testing (DAST)?
Nessus
Burp Suite
GitHub Actions
SonarQube
33
What is the main function of a Web Application Firewall (WAF)?
To filter and monitor HTTP traffic to and from a web application
To perform vulnerability scanning
To monitor network traffic
To manage user access
34
In a DevSecOps approach, security is considered:
An afterthought
A separate phase in development
A shared responsibility throughout the development lifecycle
Only the responsibility of the security team
35
Which of the following is a common practice for securing APIs in a DevSecOps environment?
Using unsecured endpoints
Ignoring authentication and authorization
Implementing rate limiting and input validation
Hardcoding API keys in the source code
36
What is the purpose of a security incident response plan in a DevSecOps environment?
To focus on performance optimization
To define how to respond to security incidents effectively
To outline how to develop software
To manage project timelines
37
What is the primary goal of DevSecOps?
To ensure security is integrated into the development process
To focus solely on operational efficiency
To eliminate the need for security testing
To improve collaboration between developers and security teams
38
What is a common challenge when implementing DevSecOps?
Lack of tools available
Too many security experts
Overly simplified processes
Resistance to change in organizational culture
39
Which of the following tools is used for API security testing?
OWASP ZAP
SoapUI
Swagger
Postman
40
Which tool is known for providing real-time threat intelligence?
Splunk
Jenkins
GitLab
ThreatConnect
41
Which of the following is an example of a security tool that can be integrated into a CI/CD pipeline?
Gitleaks
Slack
GitHub
Jenkins
42
What is the purpose of a security baseline in a DevSecOps context?
To delay security assessments
To ignore security standards
To focus solely on performance metrics
To define the minimum security requirements for systems
43
What does DevSecOps stand for?
Development, Security, and Operations
Development, Software, and Operations
Development, System, and Operations
Development, Security, and Optimization
44
Which of the following is a key practice in DevSecOps?
Continuous integration and continuous deployment (CI/CD)
Manual security audits
Isolated development environments
Delayed security assessments
45
In DevSecOps, what is the significance of container security?
Containers eliminate the need for security measures
Containers can introduce new vulnerabilities that need to be managed
Containers are not a security concern
Container security is only relevant in production
46
Which of the following tools is specifically designed for infrastructure as code (IaC) security?
GitHub Actions
Jenkins
Checkov
SonarQube
47
What is the primary function of a vulnerability scanner like Nessus?
To perform code reviews
To identify vulnerabilities in systems and applications
To automate deployment processes
To manage user permissions
48
What is the purpose of automated security testing in DevSecOps?
To ensure compliance with regulations only
To identify vulnerabilities early and often
To replace manual testing entirely
To slow down the development process
49
What is the main purpose of using a tool like OWASP ZAP?
To perform static code analysis
To conduct dynamic security testing on web applications
To manage infrastructure as code
To monitor network traffic
50
What is the role of continuous monitoring in DevSecOps?
To ensure ongoing security assessments and compliance
To monitor only production environments
To focus solely on performance metrics
To replace manual testing completely
