</>SkillByAI
🇬🇧 English
Test our app

DevSecOps interview questions

31 questions from the DevSecOps course, each with the correct answer and an explanation. Try to answer before you open the answer.

Prerequisites and the DevSecOps Mental Model

1. Which statement best describes DevSecOps?

  1. A security team that approves each release just before deployment
  2. Integrating security practices and automated checks throughout the delivery lifecycle, owned by the delivery team
  3. Replacing developers with automated security scanners
  4. Running a penetration test once a year
Show answer

Answer: Integrating security practices and automated checks throughout the delivery lifecycle, owned by the delivery team

DevSecOps spreads security across design, build, deploy and run, with the delivery team owning it and the security team providing guardrails.

Lesson: What DevSecOps Actually Means

2. Why do teams still invest in production monitoring after shifting security left?

  1. Because shift-left tools are illegal in production
  2. Because early checks make monitoring unnecessary
  3. Because some issues, such as new CVEs or misconfigurations, only appear after release
  4. Because monitoring replaces code review
Show answer

Answer: Because some issues, such as new CVEs or misconfigurations, only appear after release

Early checks catch many defects, but new vulnerabilities and runtime misconfigurations surface later, so you also need to shield right.

Lesson: Shift Left (and Shield Right)

3. What is the main job of a security champion?

  1. To be the only person allowed to approve deployments
  2. To run all penetration tests for the company
  3. To replace the central security team
  4. To act as a trained security point of contact inside a development team
Show answer

Answer: To act as a trained security point of contact inside a development team

Champions are developers with extra security training who triage, review and spread practices within their own team.

Lesson: Roles, Culture and Security Champions

Threat Modelling and Secure Design

4. An attacker modifies a price field in a request so they pay less. Which STRIDE category is this?

  1. Tampering
  2. Spoofing
  3. Repudiation
  4. Denial of service
Show answer

Answer: Tampering

Changing data in transit or at rest without authorisation violates integrity, which STRIDE calls Tampering.

Lesson: Threat Modelling with STRIDE

5. A CI job only needs to push images to one registry repository. What does least privilege suggest?

  1. Give it organisation-wide admin so it never fails
  2. Share a developer's personal token with it
  3. Grant push rights on that single repository, ideally with short-lived credentials
  4. Disable authentication on the registry for CI
Show answer

Answer: Grant push rights on that single repository, ideally with short-lived credentials

Least privilege limits both scope (one repository, push only) and time (short-lived credentials).

Lesson: Secure Design Principles

6. Which of these is a well-formed security requirement?

  1. The system should be very secure
  2. We will follow best practices
  3. Hackers must not get in
  4. All endpoints except /health reject requests without a valid access token with HTTP 401
Show answer

Answer: All endpoints except /health reject requests without a valid access token with HTTP 401

A good requirement is specific and testable; the last option can be verified with an automated test.

Lesson: Security Requirements and Abuse Cases

Secure Coding Foundations

7. Which pipeline control most directly catches known-vulnerable third-party packages (the 2021 "Vulnerable and Outdated Components" risk, now part of "Software Supply Chain Failures")?

  1. Software composition analysis (dependency scanning)
  2. A web application firewall rule for XSS
  3. Password complexity rules
  4. Load testing
Show answer

Answer: Software composition analysis (dependency scanning)

SCA tools compare your dependency versions with known vulnerability databases.

Lesson: The OWASP Top 10 as a Map

8. Why does a parameterised query prevent SQL injection?

  1. It removes all quote characters from input
  2. It encrypts the query before sending it
  3. The values are sent separately from the SQL text and are always treated as data
  4. It limits input length to 255 characters
Show answer

Answer: The values are sent separately from the SQL text and are always treated as data

The query structure is fixed before values are bound, so input can never change the SQL syntax.

Lesson: Injection and Parameterised Queries

9. Which approach to input validation is generally stronger?

  1. A deny-list of known bad strings
  2. Client-side JavaScript checks only
  3. No validation, relying only on a firewall
  4. An allow-list describing exactly what valid input looks like
Show answer

Answer: An allow-list describing exactly what valid input looks like

Allow-lists fail safe: anything not explicitly valid is rejected, so unknown attack forms are blocked too.

Lesson: Input Validation and Output Encoding

Secrets Management

10. You notice a cloud access key was pushed to a public repository an hour ago. What should you do first?

  1. Rewrite Git history to remove it
  2. Revoke and rotate the key, then review its usage logs
  3. Make the repository private and continue
  4. Add the file to .gitignore
Show answer

Answer: Revoke and rotate the key, then review its usage logs

Once public, assume it is compromised. Revoking stops abuse; history cleanup and prevention come after.

Lesson: How Secrets Leak

11. Why run a secret scan in CI if developers already have a pre-commit hook?

  1. CI scanners are always more accurate
  2. Pre-commit hooks cannot read files
  3. Hooks are local and can be skipped or not installed, so CI is the enforced check
  4. CI scans are required by Git
Show answer

Answer: Hooks are local and can be skipped or not installed, so CI is the enforced check

A pre-commit hook gives fast feedback, but only a server-side check guarantees every change was scanned.

Lesson: Secret Scanning

12. What is the main security benefit of OIDC federation for CI?

  1. No long-lived cloud credentials are stored in the CI system
  2. Builds become faster
  3. It encrypts the source code
  4. It removes the need for IAM roles
Show answer

Answer: No long-lived cloud credentials are stored in the CI system

The job proves its identity with a short-lived token and receives temporary credentials, so there is no static key to leak.

Lesson: Secret Stores and Short-Lived Credentials

Static and Dependency Analysis

13. In taint analysis, what is a "sink"?

  1. The place where untrusted data enters the program
  2. A function that cleans data
  3. A sensitive operation, such as executing SQL, that tainted data must not reach unsanitised
  4. A log file that stores scan results
Show answer

Answer: A sensitive operation, such as executing SQL, that tainted data must not reach unsanitised

Sources introduce untrusted data, sanitisers clean it, and sinks are dangerous operations where unsanitised data causes vulnerabilities.

Lesson: Static Application Security Testing (SAST)

14. Your app depends on library A, which depends on vulnerable library B. What is B called?

  1. A dev dependency
  2. A transitive dependency
  3. A peer review
  4. A sink
Show answer

Answer: A transitive dependency

Dependencies of your dependencies are transitive; lockfiles record them so SCA tools can check them.

Lesson: Dependency Scanning (SCA)

15. What question does an SBOM help you answer quickly?

  1. Is our code formatted correctly?
  2. How many developers worked on this release?
  3. What is our cloud bill?
  4. Which of our deployed releases contain a newly disclosed vulnerable component?
Show answer

Answer: Which of our deployed releases contain a newly disclosed vulnerable component?

Because the SBOM inventories every component per release, you can search it when a new advisory is published.

Lesson: Software Bill of Materials (SBOM)

Securing the CI/CD Pipeline

16. Which check is best suited to run before deploy against a running staging environment rather than on the pull request?

  1. DAST
  2. Secret scanning
  3. Linting
  4. Unit tests
Show answer

Answer: DAST

DAST needs a running application to send requests to, so it fits after deployment to a test or staging environment.

Lesson: Designing a Secure Pipeline

17. Why pin a third-party GitHub Action to a full commit SHA instead of a tag like @v3?

  1. SHAs make workflows run faster
  2. Tags are not allowed in workflow files
  3. A tag can be moved to different code, while a commit SHA always refers to the same content
  4. SHAs automatically update to the latest version
Show answer

Answer: A tag can be moved to different code, while a commit SHA always refers to the same content

Git tags are mutable references; a compromised maintainer account can repoint them. A full SHA is immutable.

Lesson: Hardening the CI System Itself

18. What does a keyless cosign verification check, beyond the signature being mathematically valid?

  1. That the image is smaller than 1 GB
  2. That the signer identity and OIDC issuer match what you expect
  3. That the image has no vulnerabilities
  4. That the registry uses HTTPS
Show answer

Answer: That the signer identity and OIDC issuer match what you expect

Keyless signatures are tied to an identity (such as a workflow path) and issuer; verifying them is what makes the signature meaningful.

Lesson: Supply Chain Integrity: Signing and Provenance

Container and Infrastructure as Code Security

19. What is the main security benefit of a multi-stage Docker build?

  1. It encrypts the image layers
  2. It lets the container run as root safely
  3. It makes the image pull from multiple registries
  4. Build tools and source code stay in the build stage and are not shipped in the final image
Show answer

Answer: Build tools and source code stay in the build stage and are not shipped in the final image

Only the copied artefacts reach the final stage, reducing size and attack surface.

Lesson: Building Hardened Container Images

20. What does Trivy's --ignore-unfixed flag do?

  1. Hides vulnerabilities that have no fixed version available yet
  2. Ignores all LOW severity findings
  3. Skips scanning the base image
  4. Automatically upgrades vulnerable packages
Show answer

Answer: Hides vulnerabilities that have no fixed version available yet

It suppresses findings with no available fix, so gates focus on vulnerabilities you can actually resolve now.

Lesson: Scanning Images with Trivy

21. Why scan the Terraform plan JSON in addition to the .tf files?

  1. Plan files are smaller
  2. Some values, such as variables and module outputs, are only resolved at plan time
  3. Scanners cannot read .tf files
  4. The plan contains the cloud provider's password
Show answer

Answer: Some values, such as variables and module outputs, are only resolved at plan time

Static .tf files may contain variables whose real values appear only in the plan, so plan scanning sees the final configuration.

Lesson: Infrastructure as Code Scanning

Runtime Security: DAST, Kubernetes and Cloud

22. Which issue is DAST better placed to find than SAST?

  1. A missing security header in the deployed web server configuration
  2. An unused variable in the code
  3. A hard-coded password in a test file
  4. A vulnerable version in a lockfile
Show answer

Answer: A missing security header in the deployed web server configuration

Headers are often set by servers, proxies or frameworks at runtime; DAST observes the real responses.

Lesson: Dynamic Testing (DAST) with ZAP

23. Which Pod Security Standard level represents current pod hardening best practice?

  1. privileged
  2. baseline
  3. restricted
  4. default
Show answer

Answer: restricted

restricted is the most locked-down level; baseline blocks known escalations; privileged is unrestricted.

Lesson: Kubernetes Workload Hardening

24. Which IAM practice best limits damage if a service's credentials are stolen?

  1. Using one shared admin role for all services
  2. Rotating the admin password every year
  3. Disabling CloudTrail to reduce noise
  4. Granting only the specific actions and resources the service needs
Show answer

Answer: Granting only the specific actions and resources the service needs

Least-privilege scope means a thief can only do what that service could do, which should be very little.

Lesson: Cloud IAM and Posture Management

Operations, Policy and Pitfalls

25. Which signal tells you a vulnerability is already being exploited by attackers?

  1. A high CVSS base score
  2. Being listed in the CISA Known Exploited Vulnerabilities catalogue
  3. Being found by SAST
  4. Having a long description
Show answer

Answer: Being listed in the CISA Known Exploited Vulnerabilities catalogue

KEV lists CVEs with evidence of active exploitation; CVSS measures severity, not whether exploitation is happening.

Lesson: Vulnerability Management and Triage

26. During an incident, what usually comes right after confirming and analysing the attack?

  1. Writing the blameless review
  2. Buying a new security tool
  3. Containment, to stop further damage
  4. Deleting all logs
Show answer

Answer: Containment, to stop further damage

After detection and analysis, you contain the attacker before eradicating the cause and recovering.

Lesson: Security Logging, Detection and Incident Response

27. Why roll out a new admission policy in audit mode first?

  1. Audit mode is faster
  2. Enforce mode is not supported by Kubernetes
  3. Audit mode encrypts violations
  4. To find and fix existing violations before blocking deployments
Show answer

Answer: To find and fix existing violations before blocking deployments

Audit mode reports what would be blocked, letting teams fix issues before enforcement breaks releases.

Lesson: Policy as Code

28. A team ignores security scan results because there are thousands of low-value findings. What is the best first step?

  1. Tune and prioritise the rules so only high-confidence, high-impact findings block or alert
  2. Add two more scanners for coverage
  3. Make every finding block the build
  4. Turn off all scanning
Show answer

Answer: Tune and prioritise the rules so only high-confidence, high-impact findings block or alert

Reducing noise restores trust in the signal; more tools or blanket blocking worsen fatigue.

Lesson: Common Pitfalls and Trade-offs

Revision and Interview Prep

29. At which stage should an SBOM ideally be generated?

  1. Once a year during an audit
  2. Only after an incident
  3. By hand from the README
  4. During the build, for each release artefact
Show answer

Answer: During the build, for each release artefact

Generating it in the build guarantees it matches exactly what was shipped.

Lesson: DevSecOps Cheat Sheet

30. An interviewer asks how you would prioritise 400 open vulnerability findings. Which answer is strongest?

  1. Fix them in the order the scanner listed them
  2. Combine severity with exploitability (EPSS, KEV), exposure and reachability, then set SLAs per priority
  3. Fix only those with CVSS 10.0
  4. Ignore them until a penetration test confirms them
Show answer

Answer: Combine severity with exploitability (EPSS, KEV), exposure and reachability, then set SLAs per priority

Risk-based prioritisation uses severity plus real-world exploitation and context, then tracks fixes against deadlines.

Lesson: Common Interview and Exam Questions

31. Which pairing of problem and control is correct?

  1. Moved Git tag in a third-party action -> pin the action to a full commit SHA
  2. SQL injection -> image signing with cosign
  3. Public S3 bucket -> secret scanning
  4. Leaked cloud key -> multi-stage Docker build
Show answer

Answer: Moved Git tag in a third-party action -> pin the action to a full commit SHA

Pinning to an immutable SHA defends against moved tags; the other pairings mix up unrelated controls.

Lesson: Mixed Self-Check

← Back to the course