Lesson 31 / 31
Mixed Self-Check
Test yourself across the whole course and identify which sections to revisit before an exam or interview.
By Rahul Agarwal · 15 years in web development
How to use this self-check
Answer each prompt below aloud or on paper before reading the hint, then take the final quiz. If you hesitate on a prompt, revisit the section named in brackets. 1. Name the six STRIDE categories and give one mitigation for each (Section 2). 2. Write a parameterised query in your favourite language and explain why it stops injection (Section 3). 3. List the steps after a secret leak, in order (Section 4). 4. Explain transitive dependencies and why lockfiles matter for SCA (Section 5). 5. Give three ways to harden GitHub Actions (Section 6). 6. Describe four lines of a hardened Dockerfile (Section 7). 7. List the securityContext settings needed for the restricted Pod Security Standard (Section 8). 8. Explain why CVSS alone is a weak priority signal (Section 9). Aim to answer all eight without notes.
Hint for prompts 5 and 7
Actions: top-level permissions: contents: read, actions pinned to full SHAs, OIDC for cloud access, no untrusted checkout in pull_request_target, untrusted input passed via env. Pods: runAsNonRoot, allowPrivilegeEscalation: false, drop ALL capabilities, seccompProfile: RuntimeDefault.
Hint for prompts 3 and 8
Leak order: revoke and rotate, check logs, clean code and history, add prevention. CVSS measures technical severity but ignores whether a CVE is exploited in the wild (EPSS, KEV) and whether your component is exposed or reachable.
Quick check: Which pairing of problem and control is correct?
- Moved Git tag in a third-party action -> pin the action to a full commit SHA
- SQL injection -> image signing with cosign
- Public S3 bucket -> secret scanning
- Leaked cloud key -> multi-stage Docker build
Answer
Moved Git tag in a third-party action -> pin the action to a full commit SHA — Pinning to an immutable SHA defends against moved tags; the other pairings mix up unrelated controls.