# Mixed Self-Check — DevSecOps

Source: https://www.skillbyai.com/en/devsecops/dso-self-check

> Test yourself across the whole course and identify which sections to revisit before an exam or interview.

## How to use this self-check

Answer each prompt below aloud or on paper before reading the hint, then take the final quiz. If you hesitate on a prompt, revisit the section named in brackets. **1.** Name the six STRIDE categories and give one mitigation for each (Section 2). **2.** Write a parameterised query in your favourite language and explain why it stops injection (Section 3). **3.** List the steps after a secret leak, in order (Section 4). **4.** Explain transitive dependencies and why lockfiles matter for SCA (Section 5). **5.** Give three ways to harden GitHub Actions (Section 6). **6.** Describe four lines of a hardened Dockerfile (Section 7). **7.** List the securityContext settings needed for the restricted Pod Security Standard (Section 8). **8.** Explain why CVSS alone is a weak priority signal (Section 9). Aim to answer all eight without notes.

## Hint for prompts 5 and 7

Actions: top-level `permissions: contents: read`, actions pinned to full SHAs, OIDC for cloud access, no untrusted checkout in `pull_request_target`, untrusted input passed via `env`. Pods: `runAsNonRoot`, `allowPrivilegeEscalation: false`, drop `ALL` capabilities, `seccompProfile: RuntimeDefault`.

## Hint for prompts 3 and 8

Leak order: revoke and rotate, check logs, clean code and history, add prevention. CVSS measures technical severity but ignores whether a CVE is exploited in the wild (EPSS, KEV) and whether your component is exposed or reachable.

**Quiz:** Which pairing of problem and control is correct?

- [x] Moved Git tag in a third-party action -> pin the action to a full commit SHA
- [ ] SQL injection -> image signing with cosign
- [ ] Public S3 bucket -> secret scanning
- [ ] Leaked cloud key -> multi-stage Docker build

*Answer:* Moved Git tag in a third-party action -> pin the action to a full commit SHA. Pinning to an immutable SHA defends against moved tags; the other pairings mix up unrelated controls.