DevSecOps Interview Questions Hindi mein

जवाब: Integrating security practices and automated checks throughout the delivery lifecycle, owned by the delivery team

DevSecOps spreads security across design, build, deploy and run, with the delivery team owning it and the security team providing guardrails.

जवाब: Because some issues, such as new CVEs or misconfigurations, only appear after release

Early checks catch many defects, but new vulnerabilities and runtime misconfigurations surface later, so you also need to shield right.

जवाब: To act as a trained security point of contact inside a development team

Champions are developers with extra security training who triage, review and spread practices within their own team.

जवाब: Tampering

Changing data in transit or at rest without authorisation violates integrity, which STRIDE calls Tampering.

जवाब: Grant push rights on that single repository, ideally with short-lived credentials

Least privilege limits both scope (one repository, push only) and time (short-lived credentials).

जवाब: All endpoints except /health reject requests without a valid access token with HTTP 401

A good requirement is specific and testable; the last option can be verified with an automated test.

जवाब: Software composition analysis (dependency scanning)

SCA tools compare your dependency versions with known vulnerability databases.

जवाब: The values are sent separately from the SQL text and are always treated as data

The query structure is fixed before values are bound, so input can never change the SQL syntax.

जवाब: An allow-list describing exactly what valid input looks like

Allow-lists fail safe: anything not explicitly valid is rejected, so unknown attack forms are blocked too.

जवाब: Revoke and rotate the key, then review its usage logs

Once public, assume it is compromised. Revoking stops abuse; history cleanup and prevention come after.

जवाब: Hooks are local and can be skipped or not installed, so CI is the enforced check

A pre-commit hook gives fast feedback, but only a server-side check guarantees every change was scanned.

जवाब: No long-lived cloud credentials are stored in the CI system

The job proves its identity with a short-lived token and receives temporary credentials, so there is no static key to leak.

जवाब: A sensitive operation, such as executing SQL, that tainted data must not reach unsanitised

Sources introduce untrusted data, sanitisers clean it, and sinks are dangerous operations where unsanitised data causes vulnerabilities.

जवाब: A transitive dependency

Dependencies of your dependencies are transitive; lockfiles record them so SCA tools can check them.

जवाब: Which of our deployed releases contain a newly disclosed vulnerable component?

Because the SBOM inventories every component per release, you can search it when a new advisory is published.

जवाब: DAST

DAST needs a running application to send requests to, so it fits after deployment to a test or staging environment.

जवाब: A tag can be moved to different code, while a commit SHA always refers to the same content

Git tags are mutable references; a compromised maintainer account can repoint them. A full SHA is immutable.

जवाब: That the signer identity and OIDC issuer match what you expect

Keyless signatures are tied to an identity (such as a workflow path) and issuer; verifying them is what makes the signature meaningful.

जवाब: Build tools and source code stay in the build stage and are not shipped in the final image

Only the copied artefacts reach the final stage, reducing size and attack surface.

जवाब: Hides vulnerabilities that have no fixed version available yet

It suppresses findings with no available fix, so gates focus on vulnerabilities you can actually resolve now.

जवाब: Some values, such as variables and module outputs, are only resolved at plan time

Static .tf files may contain variables whose real values appear only in the plan, so plan scanning sees the final configuration.

जवाब: A missing security header in the deployed web server configuration

Headers are often set by servers, proxies or frameworks at runtime; DAST observes the real responses.

जवाब: restricted

restricted is the most locked-down level; baseline blocks known escalations; privileged is unrestricted.

जवाब: Granting only the specific actions and resources the service needs

Least-privilege scope means a thief can only do what that service could do, which should be very little.

जवाब: Being listed in the CISA Known Exploited Vulnerabilities catalogue

KEV lists CVEs with evidence of active exploitation; CVSS measures severity, not whether exploitation is happening.

जवाब: Containment, to stop further damage

After detection and analysis, you contain the attacker before eradicating the cause and recovering.

जवाब: To find and fix existing violations before blocking deployments

Audit mode reports what would be blocked, letting teams fix issues before enforcement breaks releases.

जवाब: Tune and prioritise the rules so only high-confidence, high-impact findings block or alert

Reducing noise restores trust in the signal; more tools or blanket blocking worsen fatigue.

जवाब: During the build, for each release artefact

Generating it in the build guarantees it matches exactly what was shipped.

जवाब: Combine severity with exploitability (EPSS, KEV), exposure and reachability, then set SLAs per priority

Risk-based prioritisation uses severity plus real-world exploitation and context, then tracks fixes against deadlines.

जवाब: Moved Git tag in a third-party action -> pin the action to a full commit SHA

Pinning to an immutable SHA defends against moved tags; the other pairings mix up unrelated controls.