DevOps Security in DevOps Syllabus

Security in DevOps syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Security in DevOps in DevOps, not a summary of it.

1. 1

   Introduction to DevSecOps

   2 topics

   • Security Concepts and Practices
   • Benefits of DevSecOps
2. 2

   Security Tools

   4 topics

   • OWASP ZAP
   • Snyk
   • Aqua Security
   • Clair
3. 3

   Implementing Security in CI/CD

   3 topics

   • Static Application Security Testing (SAST)
   • Dynamic Application Security Testing (DAST)
   • Container Security

Security in DevOps flashcards for DevOps

25 of 50 cards from the Security in DevOps deck — real questions with worked answers.

1. What is DevSecOps?

   DevSecOps is the practice of integrating security as a shared responsibility throughout the entire DevOps lifecycle, embedding security checks and controls into every phase of development and operations rather than bolting them on at the end.

2. What does the principle 'shift left' mean in security?

   Shifting left means moving security testing and controls earlier in the software development lifecycle (toward design and coding) so vulnerabilities are caught and fixed sooner, when they are cheaper and easier to remediate.

3. What is the CIA triad in information security?

   The three core security objectives: Confidentiality (data is accessible only to authorized parties), Integrity (data is accurate and unaltered), and Availability (systems and data are accessible when needed).

4. What is the principle of least privilege?

   Granting each user, process, or system only the minimum permissions and access rights necessary to perform its function, reducing the attack surface and limiting damage from a compromise.

5. What is defense in depth?

   A security strategy that layers multiple independent controls (network, host, application, data) so that if one layer fails, others still protect the system.

6. List three key benefits of DevSecOps.

   1) Earlier detection of vulnerabilities (lower remediation cost), 2) Faster, more secure delivery through automation, and 3) Shared security responsibility and culture across teams. (Also: continuous compliance and reduced breach risk.)

7. How does DevSecOps reduce the cost of fixing vulnerabilities?

   By shifting security left and automating checks in CI/CD, defects are found during coding/build instead of production; the cost to fix a defect rises sharply across SDLC stages, so early detection is dramatically cheaper.

8. What is 'security as code'?

   Defining and managing security policies, controls, and tests as version-controlled, automated code (e.g., policy-as-code, IaC scanning, pipeline gates) so security is repeatable, auditable, and integrated into CI/CD.

9. What is the difference between a vulnerability, a threat, and a risk?

   A vulnerability is a weakness; a threat is a potential event/actor that could exploit it; risk is the likelihood of a threat exploiting a vulnerability combined with the resulting impact.

10. Give the qualitative formula for security risk.

    $\text{Risk} = \text{Likelihood} \times \text{Impact}$

11. What is SAST (Static Application Security Testing)?

    A white-box testing method that analyzes an application's source code, bytecode, or binaries without executing it, to find vulnerabilities like injection flaws, insecure coding patterns, and hardcoded secrets early in development.

12. What is DAST (Dynamic Application Security Testing)?

    A black-box testing method that tests a running application from the outside by sending inputs/attacks to its interfaces, detecting runtime vulnerabilities without access to source code.

13. Contrast SAST vs DAST: code access, timing, and visibility.

    SAST is white-box (needs source/binary), runs early without execution, and pinpoints exact code locations. DAST is black-box (no source needed), runs against a deployed/running app later, and finds runtime/configuration issues but not exact code lines.

14. Why does SAST tend to produce more false positives than DAST?

    SAST reasons about all possible code paths without runtime context, so it flags potential issues that may be unreachable or mitigated at runtime; DAST observes actual behavior, confirming exploitability but missing unexercised paths.

15. What is IAST (Interactive Application Security Testing)?

    A hybrid approach that instruments a running application with agents to analyze code from the inside during execution, combining SAST-like code insight with DAST-like runtime accuracy.

16. Which classes of vulnerabilities is DAST better suited to find than SAST?

    Runtime and environment-dependent issues: authentication/session flaws, server misconfigurations, and problems visible only when the app is deployed and running. SAST better finds source-level flaws like insecure code patterns and hardcoded secrets.

17. What is SCA (Software Composition Analysis)?

    Analysis that identifies open-source and third-party components in a codebase to detect known vulnerabilities (CVEs) and license compliance issues in dependencies.

18. What is OWASP ZAP?

    OWASP Zed Attack Proxy: a free, open-source DAST tool that acts as a man-in-the-middle proxy to intercept and test web application traffic for vulnerabilities, supporting both automated and manual penetration testing.

19. What scanning modes does OWASP ZAP support?

    An automated/active scan (actively attacks the target to find vulnerabilities) and a passive scan (observes traffic without sending attacks), plus a spider/crawler to discover endpoints and a manual proxy mode.

20. In OWASP ZAP, what is the difference between active and passive scanning?

    Passive scanning inspects requests/responses without modifying or attacking the app (safe, non-intrusive). Active scanning sends crafted malicious requests to actively probe for exploitable vulnerabilities (intrusive, can alter data).

21. What category of testing tool is OWASP ZAP (SAST, DAST, or SCA)?

    DAST — it tests a running web application from the outside.

22. What is Snyk?

    A developer-focused security platform that finds and fixes vulnerabilities in open-source dependencies, code, containers, and infrastructure-as-code, with automated fix suggestions and pull-request integration.

23. Name the main product areas of Snyk.

    Snyk Open Source (SCA for dependencies), Snyk Code (SAST), Snyk Container (container image scanning), and Snyk IaC (infrastructure-as-code misconfiguration scanning).

24. What is the primary purpose of Snyk Open Source?

    To perform Software Composition Analysis—scanning project dependencies against a vulnerability database to detect known vulnerabilities and license issues, and suggesting upgrade or patch fixes.

25. What is Aqua Security?

    A cloud-native security platform that protects containers, Kubernetes, serverless, and cloud workloads across the full lifecycle—from image scanning in CI/CD to runtime protection and compliance.

See more Security in DevOps flashcards →

Planning Security in DevOps for DevOps

Security in DevOps (DevOps) FAQ