DevSecOps Study Portal

Quick recall Q&A

1. What is "Shift Left" security?

Moving security practices earlier in the SDLC:

• Security requirements during planning
• SAST during development
• Dependency scanning in CI
• Container scanning before deployment
• Automated security gates in pipeline

2. How do you handle secrets in CI/CD?

1. Never commit secrets to code
2. Use CI/CD secret management (GitHub Secrets, Azure Key Vault)
3. OIDC authentication instead of long-lived credentials
4. Rotate secrets regularly
5. Least privilege access
6. Audit secret access

3. Explain container security layers

1. Base Image: Minimal, trusted, scanned
2. Build Process: Multi-stage, no secrets in layers
3. Runtime: Non-root, read-only filesystem, no capabilities
4. Network: Network policies, mTLS
5. Orchestration: Pod security standards, RBAC

4. What is Policy as Code?

• Define security/compliance rules as code
• Automated enforcement in CI/CD and runtime
• Version controlled, auditable
• Tools: OPA, Kyverno, Checkov
• Examples: Require resource limits, block privileged containers