Lesson 30 / 31
Common Interview and Exam Questions
Answer the DevSecOps questions most often asked in interviews and exams with structured, example-backed responses.
By Rahul Agarwal · 15 years in web development
How to structure answers
Interviewers rarely want definitions alone; they want to see that you can apply them. A reliable structure is define, explain why, give an example, mention a trade-off. For example, asked what is shift left?, define it (moving security checks earlier in the lifecycle), explain why (cheaper, faster feedback), give an example (secret scanning in a pre-commit hook and SAST on pull requests) and a trade-off (early checks cannot see runtime issues, so you still monitor production). Frequently asked questions include: the difference between SAST, DAST and SCA; how you would handle a secret committed to a public repository; how to secure a CI/CD pipeline; what an SBOM is and why it helps; how you prioritise hundreds of vulnerabilities; what least privilege means for a Kubernetes pod; and how you would introduce security tooling without slowing teams down. Practise answering each in about a minute.
Model answer: SAST vs DAST vs SCA
SAST reads your source without running it and finds insecure code paths early, with more false positives. DAST attacks the running app from outside and finds runtime and configuration issues, but only on reachable paths. SCA checks third-party dependencies against vulnerability databases. A mature pipeline uses all three.
Model answer: leaked secret
- Revoke and rotate the secret immediately. 2) Check provider logs for misuse during the exposure window. 3) Remove it from code and, if needed, history. 4) Add prevention: pre-commit and CI secret scanning, push protection, and move the value to a secret manager or replace it with OIDC.
A doctor's diagnosis
A good doctor does not just name the illness; they explain the cause, the treatment and the side effects. Interview answers land the same way: definition, reason, example, trade-off.
Quick check: An interviewer asks how you would prioritise 400 open vulnerability findings. Which answer is strongest?
- Fix them in the order the scanner listed them
- Combine severity with exploitability (EPSS, KEV), exposure and reachability, then set SLAs per priority
- Fix only those with CVSS 10.0
- Ignore them until a penetration test confirms them
Answer
Combine severity with exploitability (EPSS, KEV), exposure and reachability, then set SLAs per priority — Risk-based prioritisation uses severity plus real-world exploitation and context, then tracks fixes against deadlines.