Examius

🌍 DevOps · subject

DevOps Security in DevOps Syllabus

The Security in DevOps syllabus for DevOps in full: 3 chapters and 9 topics, every one listed below, plus 50 Security in DevOps flashcards with answers.

3Chapters
9Topics
50Flashcards

Security in DevOps syllabus: all 3 chapters

Expand any chapter to see its topics and sub-topics.

  1. Introduction to DevSecOps

     2 topics
    • Security Concepts and Practices
    • Benefits of DevSecOps

  2. Security Tools

     4 topics
    • OWASP ZAP
    • Snyk
    • Aqua Security
    • Clair

  3. Implementing Security in CI/CD

     3 topics
    • Static Application Security Testing (SAST)
    • Dynamic Application Security Testing (DAST)
    • Container Security

DevOps Security in DevOps flashcards — 50 questions with answers

  1. What is DevSecOps?

    DevSecOps is the practice of integrating security as a shared responsibility throughout the entire DevOps lifecycle, embedding security checks and controls into every phase of development and operations rather than bolting them on at the end.

  2. What does the principle 'shift left' mean in security?

    Shifting left means moving security testing and controls earlier in the software development lifecycle (toward design and coding) so vulnerabilities are caught and fixed sooner, when they are cheaper and easier to remediate.

  3. What is the CIA triad in information security?

    The three core security objectives: Confidentiality (data is accessible only to authorized parties), Integrity (data is accurate and unaltered), and Availability (systems and data are accessible when needed).

  4. What is the principle of least privilege?

    Granting each user, process, or system only the minimum permissions and access rights necessary to perform its function, reducing the attack surface and limiting damage from a compromise.

  5. What is defense in depth?

    A security strategy that layers multiple independent controls (network, host, application, data) so that if one layer fails, others still protect the system.

  6. List three key benefits of DevSecOps.

    1) Earlier detection of vulnerabilities (lower remediation cost), 2) Faster, more secure delivery through automation, and 3) Shared security responsibility and culture across teams. (Also: continuous compliance and reduced breach risk.)

  7. How does DevSecOps reduce the cost of fixing vulnerabilities?

    By shifting security left and automating checks in CI/CD, defects are found during coding/build instead of production; the cost to fix a defect rises sharply across SDLC stages, so early detection is dramatically cheaper.

  8. What is 'security as code'?

    Defining and managing security policies, controls, and tests as version-controlled, automated code (e.g., policy-as-code, IaC scanning, pipeline gates) so security is repeatable, auditable, and integrated into CI/CD.

  9. What is the difference between a vulnerability, a threat, and a risk?

    A vulnerability is a weakness; a threat is a potential event/actor that could exploit it; risk is the likelihood of a threat exploiting a vulnerability combined with the resulting impact.

  10. Give the qualitative formula for security risk.

    $\text{Risk} = \text{Likelihood} \times \text{Impact}$

  11. What is SAST (Static Application Security Testing)?

    A white-box testing method that analyzes an application's source code, bytecode, or binaries without executing it, to find vulnerabilities like injection flaws, insecure coding patterns, and hardcoded secrets early in development.

  12. What is DAST (Dynamic Application Security Testing)?

    A black-box testing method that tests a running application from the outside by sending inputs/attacks to its interfaces, detecting runtime vulnerabilities without access to source code.

  13. Contrast SAST vs DAST: code access, timing, and visibility.

    SAST is white-box (needs source/binary), runs early without execution, and pinpoints exact code locations. DAST is black-box (no source needed), runs against a deployed/running app later, and finds runtime/configuration issues but not exact code lines.

  14. Why does SAST tend to produce more false positives than DAST?

    SAST reasons about all possible code paths without runtime context, so it flags potential issues that may be unreachable or mitigated at runtime; DAST observes actual behavior, confirming exploitability but missing unexercised paths.

  15. What is IAST (Interactive Application Security Testing)?

    A hybrid approach that instruments a running application with agents to analyze code from the inside during execution, combining SAST-like code insight with DAST-like runtime accuracy.

  16. Which classes of vulnerabilities is DAST better suited to find than SAST?

    Runtime and environment-dependent issues: authentication/session flaws, server misconfigurations, and problems visible only when the app is deployed and running. SAST better finds source-level flaws like insecure code patterns and hardcoded secrets.

  17. What is SCA (Software Composition Analysis)?

    Analysis that identifies open-source and third-party components in a codebase to detect known vulnerabilities (CVEs) and license compliance issues in dependencies.

  18. What is OWASP ZAP?

    OWASP Zed Attack Proxy: a free, open-source DAST tool that acts as a man-in-the-middle proxy to intercept and test web application traffic for vulnerabilities, supporting both automated and manual penetration testing.

  19. What scanning modes does OWASP ZAP support?

    An automated/active scan (actively attacks the target to find vulnerabilities) and a passive scan (observes traffic without sending attacks), plus a spider/crawler to discover endpoints and a manual proxy mode.

  20. In OWASP ZAP, what is the difference between active and passive scanning?

    Passive scanning inspects requests/responses without modifying or attacking the app (safe, non-intrusive). Active scanning sends crafted malicious requests to actively probe for exploitable vulnerabilities (intrusive, can alter data).

Show the other 30 Security in DevOps flashcards

  1. What category of testing tool is OWASP ZAP (SAST, DAST, or SCA)?

    DAST — it tests a running web application from the outside.

  2. What is Snyk?

    A developer-focused security platform that finds and fixes vulnerabilities in open-source dependencies, code, containers, and infrastructure-as-code, with automated fix suggestions and pull-request integration.

  3. Name the main product areas of Snyk.

    Snyk Open Source (SCA for dependencies), Snyk Code (SAST), Snyk Container (container image scanning), and Snyk IaC (infrastructure-as-code misconfiguration scanning).

  4. What is the primary purpose of Snyk Open Source?

    To perform Software Composition Analysis—scanning project dependencies against a vulnerability database to detect known vulnerabilities and license issues, and suggesting upgrade or patch fixes.

  5. What is Aqua Security?

    A cloud-native security platform that protects containers, Kubernetes, serverless, and cloud workloads across the full lifecycle—from image scanning in CI/CD to runtime protection and compliance.

  6. What is the open-source scanner associated with Aqua Security?

    Trivy — a fast, comprehensive open-source scanner for container images, filesystems, and repositories that detects vulnerabilities, misconfigurations, secrets, and SBOM components.

  7. What is Clair?

    An open-source project for the static analysis of vulnerabilities in container images (originally from CoreOS), which indexes image layers and matches installed packages against known CVE databases.

  8. How does Clair detect vulnerabilities in container images?

    It statically analyzes each image layer, extracts the list of installed packages, and cross-references them against vulnerability data sources (CVE feeds) to report known vulnerabilities; it does not run the container.

  9. What is container security?

    The practice of securing containerized applications and their infrastructure across the lifecycle—image, registry, orchestration (e.g., Kubernetes), and runtime—covering image scanning, configuration hardening, access control, and runtime threat detection.

  10. What are the typical phases of the container security lifecycle?

    Build (scan images, secure base images), Ship/Registry (signing, registry access control), and Run (runtime protection, network policies, monitoring)—often summarized as build, ship, and run.

  11. Why are minimal/distroless base images recommended for container security?

    They contain fewer packages and tools, which shrinks the attack surface, reduces the number of potential CVEs, and removes shells/utilities an attacker could abuse.

  12. What does image scanning detect in container security?

    Known vulnerabilities (CVEs) in OS packages and application dependencies, embedded secrets, malware, and misconfigurations within a container image before deployment.

  13. What is an SBOM (Software Bill of Materials)?

    A formal, machine-readable inventory of all components, libraries, and dependencies in a piece of software, used to track provenance and quickly assess exposure to newly disclosed vulnerabilities.

  14. What does CVE stand for and what is it?

    Common Vulnerabilities and Exposures—a standardized identifier (e.g., CVE-2021-44228) for a publicly disclosed security vulnerability, enabling consistent reference across tools and databases.

  15. What is CVSS and what range does its base score use?

    Common Vulnerability Scoring System—a standard for rating the severity of vulnerabilities. The base score ranges from $0.0$ to $10.0$, with higher values indicating greater severity.

  16. State the CVSS severity rating bands.

    None: $0.0$; Low: $0.1\text{–}3.9$; Medium: $4.0\text{–}6.9$; High: $7.0\text{–}8.9$; Critical: $9.0\text{–}10.0$.

  17. What is the OWASP Top 10?

    A regularly updated awareness document listing the ten most critical web application security risks (e.g., Broken Access Control, Injection, Cryptographic Failures), used to prioritize defenses.

  18. What is injection (e.g., SQL injection) and a primary defense?

    Injection occurs when untrusted input is interpreted as part of a command/query, letting attackers execute unintended operations. Primary defenses: parameterized queries/prepared statements and input validation.

  19. What is broken access control?

    A failure to properly enforce restrictions on what authenticated users can do, allowing unauthorized access to data or functions (e.g., IDOR, privilege escalation). It is the OWASP Top 10 #1 risk in the 2021 list.

  20. What is the difference between authentication and authorization?

    Authentication verifies who a user is (identity); authorization determines what an authenticated user is permitted to do (access rights).

  21. What is secrets management in DevSecOps?

    Securely storing, accessing, and rotating sensitive credentials (API keys, passwords, tokens, certificates) using tools like vaults, instead of hardcoding them in source code or config files.

  22. What is policy as code?

    Expressing security and compliance policies in a high-level declarative language (e.g., Open Policy Agent/Rego) so they can be version-controlled and automatically enforced in pipelines and at runtime.

  23. Where in a CI/CD pipeline is SAST typically run versus DAST?

    SAST runs early—on commit/build against source code. DAST runs later—against a deployed/running application in a test or staging environment after the build is deployed.

  24. What is a security gate (quality gate) in a CI/CD pipeline?

    An automated checkpoint that fails the build or blocks promotion when security criteria are not met (e.g., a critical vulnerability is found), preventing insecure code from progressing.

  25. What is the difference between agentless and agent-based runtime container security?

    Agent-based deploys a sidecar/agent inside the host or pod to monitor and enforce at runtime (deeper visibility); agentless inspects via APIs or snapshots without installing software in the workload (lower overhead, less runtime control).

  26. What is a false negative in security testing and why is it dangerous?

    A false negative is a real vulnerability that the tool fails to report. It is dangerous because the flaw remains undetected and exploitable, giving a false sense of security.

  27. What does 'attack surface' mean?

    The sum of all points (entry/exit points, interfaces, services, code paths) where an attacker can try to enter, extract data from, or exploit a system; reducing it lowers risk.

  28. Which tool would you use to scan a Docker image for known CVEs: OWASP ZAP, Clair, or both?

    Clair—it statically analyzes container image layers for known CVEs. OWASP ZAP is a DAST tool for running web applications, not image scanning.

  29. Compare Snyk and Clair in scope.

    Snyk is a broad commercial platform covering dependencies (SCA), code (SAST), containers, and IaC with fix automation. Clair is a focused open-source tool that only performs static vulnerability scanning of container images.

  30. What is image signing and why does it matter for container security?

    Cryptographically signing container images (e.g., with Cosign/Notary) verifies their origin and integrity, ensuring only trusted, untampered images are deployed and preventing supply-chain tampering.

DevOps Security in DevOps FAQ

What is in the DevOps Security in DevOps syllabus?

DevOps Security in DevOps is split into 3 chapters: Introduction to DevSecOps, Security Tools and Implementing Security in CI/CD. Together they contain 9 topics.

How many chapters are in DevOps Security in DevOps?

3 chapters, containing 9 topics. The largest chapter is Security Tools, with 4 topics.

Are there flashcards for DevOps Security in DevOps?

Yes — a 50-card Security in DevOps deck, printed in full in the flashcards section of this page and available in the Examius app with spaced repetition. The free plan covers one exam of your choice, including its flashcards; Examius Pro, a one-time purchase, unlocks every other exam and deck.