DevSecOps Basics: Essential Security in CI/CD Quiz Quiz

Explore fundamental concepts of DevSecOps and security integration within CI/CD pipelines. This quiz covers key practices, risks, and security controls to help reinforce secure software delivery processes.

1. CI/CD and Early Security

   Why is it important to integrate security checks early in the CI/CD pipeline rather than only at the end?

   1. It detects vulnerabilities before they become harder to fix
   2. It focuses only on speeding up deployments
   3. It increases the time required for deployment
   4. It eliminates the need for manual code reviews

   Explanation: Detecting vulnerabilities early in the CI/CD pipeline helps to address issues before they are deeply embedded, making fixes less costly and time-consuming. Increasing deployment time is not a beneficial goal. Eliminating manual code reviews or only speeding up deployments are not primary reasons for early security integration. Early detection is key for effective security.

2. Static Application Security Testing

   What is the main goal of Static Application Security Testing (SAST) in a CI process?

   1. To test network firewalls during runtime
   2. To automate delivery to production environments
   3. To monitor system activity after release
   4. To identify security flaws in source code before deployment

   Explanation: SAST analyzes the source code to find vulnerabilities before the application is deployed, preventing issues from reaching production. Monitoring after release is related to runtime, not source code analysis. Testing firewalls is a separate network security activity, and automating delivery focuses on deployment, not code security.

3. Common Security Risks

   What type of risk is presented by leaking secrets, such as API keys, in version control within CI/CD?

   1. Reducing development costs
   2. Improving system performance
   3. Exposing sensitive information to unauthorized users
   4. Increasing code readability

   Explanation: Leaking secrets in version control makes them accessible to anyone with access, which can lead to unauthorized access or exploitation. It does not improve performance or reduce costs—on the contrary, it increases risk. Additionally, leaking secrets does not make code more readable; it compromises security.

4. Least Privilege Principle

   Implementing the principle of least privilege in CI/CD means which of the following?

   1. Granting users and processes only the access necessary for their tasks
   2. Sharing credentials among the whole development team
   3. Allowing all users administrative rights for convenience
   4. Disabling all access controls for faster workflow

   Explanation: The principle of least privilege ensures that each user or process has only the permissions required to perform their function, reducing potential security breaches. Granting administrative rights or sharing credentials increases risk. Disabling access controls undermines the security posture and opens up vulnerabilities.

5. Vulnerability Remediation

   When a vulnerability is detected during automated CI/CD security scans, what should happen next?

   1. The pipeline should ignore all issues and continue deployment
   2. The vulnerability should be reported only after production release
   3. All security tickets should be closed automatically
   4. The development team should review and fix the issue before proceeding

   Explanation: Fixing vulnerabilities before deployment helps prevent exploitable flaws from reaching production. Ignoring issues undermines security. Closing tickets automatically removes the chance for real remediation. Waiting until after production increases risks and remediation costs.

6. Dependency Management

   What is the primary purpose of scanning dependencies in a CI/CD pipeline?

   1. To remove comments from the code
   2. To speed up the build process
   3. To detect known security vulnerabilities in used libraries
   4. To reduce the size of source files

   Explanation: Dependency scanning checks for vulnerabilities in libraries and components, which may introduce security risks if left unchecked. Speeding up builds, reducing file size, or removing comments do not address security issues associated with dependencies. Security scanning helps ensure safe use of third-party code.

7. Environment Isolation

   Why should development, testing, and production environments remain isolated in a secure CI/CD process?

   1. To simplify database configurations
   2. To enable developers to bypass all security checks
   3. To allow unrestricted user access to all environments
   4. To prevent unauthorized access or accidental changes affecting production

   Explanation: Isolating environments limits the impact of unauthorized access or mistakes in lower environments from affecting live systems. Allowing unrestricted access or bypassing checks increases risk, not mitigates it. Simplifying database configurations is unrelated to environmental isolation and does not focus on security.

8. Security Testing Types

   Which type of security testing examines a running application for vulnerabilities during execution in the CI/CD process?

   1. Dynamic Application Security Testing (DAST)
   2. Static Code Analysis
   3. Configuration Management Testing
   4. Unit Testing Security

   Explanation: DAST analyzes applications during runtime to uncover security weaknesses while operating. Static code analysis reviews source code, not running applications. Configuration management relates to settings, not live vulnerability scanning. Unit testing checks code logic, not security vulnerabilities during execution.

9. Role of Automated Security Gates

   What is the main function of automated security gates in a CI/CD pipeline?

   1. To automatically block deployments if security criteria are not met
   2. To manually approve every code change
   3. To test only performance metrics
   4. To monitor server uptime exclusively

   Explanation: Automated security gates enforce security policies by preventing deployments when issues are found. Manual approvals are time-consuming and not automated. Monitoring server uptime and testing performance do not ensure security requirements are met before delivery.

10. Secure Secrets Management

    Which practice helps protect sensitive credentials stored within the CI/CD pipeline?

    1. Saving passwords in plain text files in the repository
    2. Committing keys directly to public source code
    3. Storing secrets in encrypted environment variables
    4. Sharing secrets over email with the whole team

    Explanation: Encrypted environment variables safeguard credentials from exposure during the build and deployment process. Storing secrets in plain text, committing them to public source code, or distributing them via email are insecure practices that greatly increase the risk of leakage or compromise.