1. What is DevSecOps?
a) A security team that works with developers
b) A development team that prioritizes security
c) A process that integrates security into the development cycle
Answer: c
2. What is the benefit of incorporating security in the development cycle?
a) Reducing vulnerability exposure
b) Faster time-to-market
c) Cheaper development costs
Answer: a
3. What is a security test?
a) A vulnerability scan
b) A penetration test
c) Both
Answer: c
4. Which type of testing addresses just one part of the application?
a) Integration testing
b) Unit testing
c) System testing
Answer: b
5. Which type of testing assesses the entire application?
a) Integration testing
b) Unit testing
c) System testing
Answer: c
6. What is the goal of security testing?
a) Find and fix security flaws
b) Test software functionality
c) Evaluate user experience
Answer: a
7. What is Threat Modeling?
a) A software design process that identifies potential security threats
b) A security test
c) A security control
Answer: a
8. What is Continuous Integration?
a) A software development methodology
b) A process of compiling source code
c) A process of merging source code changes
Answer: c
9. What is Continuous Deployment?
a) A process of testing code changes automatically
b) A process of releasing code changes automatically
c) A process of merging code changes automatically
Answer: b
10. Which of the following is NOT a security responsibility for DevSecOps?
a) Creating new code
b) Testing
c) Monitoring
Answer: a
11. Which of the following is a version control tool?
a) Git
b) Jenkins
c) Docker
Answer: a
12. What is the principle of least privilege?
a) Users should have access to only the resources needed to perform their job
b) Users should have access to all resources to perform their job
c) Users should have access to fewer resources than needed to perform their job
Answer: a
13. What is the difference between VPN and SSH?
a) VPN is a method of remote access while SSH is a method of secure communication
b) VPN is a method of secure communication while SSH is a method of remote access
c) VPN and SSH are the same thing
Answer: a
14. Which of the following statements is true about encryption?
a) It is a security control that protects data in transit and at rest
b) It is not effective against adversaries with powerful computing systems
c) It is an outdated security technology
Answer: a
15. What is a threat?
a) An event that has already occurred
b) A potential event that could occur in the future
c) A security control
Answer: b
16. Which aspect of security should be considered during the design phase of software development?
a) Authentication
b) Authorization
c) All of the above
Answer: c
17. Which of the following is not a security control?
a) Authentication
b) Authorization
c) Post-mortem testing
Answer: c
18. Which of the following is a security best practice?
a) Passwords should not be changed frequently
b) Passwords should be easy to remember
c) Passwords should be complex and changed regularly
Answer: c
19. What is an SQL injection attack?
a) An attack that targets the website
b) An attack that targets the database
c) An attack that targets users
Answer: b
20. What is a Distributed Denial-of-Service (DDoS) attack?
a) An attack that targets the website
b) An attack that targets the database
c) An attack that targets users
Answer: a
21. What is a Man-in-the-Middle (MITM) attack?
a) An attack that targets the website
b) An attack that targets the database
c) An attack that intercepts data in transit
Answer: c
22. What is Firewall?
a) A security control that filters incoming or outgoing traffic based on predefined rules
b) A security control that scans for vulnerabilities
c) A security control that encrypts data in transit
Answer: a
23. What is a honeypot?
a) A security control that monitors network traffic
b) A security control that lures attackers to a fake system to gather information
c) A security control that blocks traffic from known malicious sources
Answer: b
24. What is a captcha?
a) A security control designed to differentiate between humans and automated bots
b) A security control designed to block traffic from specific IP addresses
c) A security control designed to monitor network traffic
Answer: a
25. What is a vulnerability?
a) A weakness in a system that can be exploited by an attacker
b) An attack on a system
c) A security control
Answer: a
26. What is a zero-day vulnerability?
a) A vulnerability that has not yet been discovered
b) A vulnerability that has been discovered but for which there is no fix or remediation available
c) A vulnerability that has been discovered and a patch or remediation is available
Answer: a
27. What is a patch?
a) A fix or update to a vulnerability or security bug
b) A security control
c) A security control that monitors network traffic
Answer: a
28. What is a security bug?
a) A programming error that can lead to security vulnerabilities
b) A security control
c) A vulnerability that has been patched
Answer: a
29. What is a threat actor?
a) An adversary or attacker
b) A security control
c) A vulnerability in a system
Answer: a
30. What is social engineering?
a) The use of deception to manipulate individuals into divulging confidential information
b) A security control
c) The use of automated tools to scan for vulnerabilities
Answer: a
31. What is a risk?
a) A measure of the likelihood of a threat occurring and its potential impact
b) A security control
c) A vulnerability in a system
Answer: a
32. What is an incident response plan?
a) A plan of action for responding to a security breach or incident
b) A security control
c) A vulnerability in a system
Answer: a
33. What is compliance?
a) Adhering to legal or regulatory standards
b) A security control
c) A vulnerability in a system
Answer: a
34. What is access control?
a) A security control that defines who is authorized to access specific resources
b) A security control that scans for vulnerabilities
c) A security control that monitors network traffic
Answer: a
35. What is a web application firewall?
a) A security control that filters incoming or outgoing traffic based on predefined rules specific to web applications
b) A security control that encrypts data in transit
c) A security control that limits access to specific resources based on user credentials
Answer: a
36. What is containerization?
a) A technology that allows multiple applications to run on the same server yet still remain isolated
b) A security control
c) A vulnerability in a system
Answer: a
37. What is least privilege?
a) A security principle that states that individuals should have only the minimum level of access necessary to perform their job functions
b) A security control that limits access to resources based on user credentials
c) A security control that scans for vulnerabilities
Answer: a
38. What is a threat model?
a) A structured approach to identifying potential security threats before they can be exploited
b) A security control
c) A vulnerability in a system
Answer: a
39. What is a CI/CD pipeline?
a) A continuous integration / continuous deployment pipeline that automates the development process from coding to production
b) A security control that filters incoming or outgoing traffic based on predefined rules
c) A vulnerability in a system
Answer: a
40. What is a security baseline?
a) A set of minimum security standards that ensures security consistency across an organization
b) A security control that blocks traffic from known malicious sources
c) A security control that scans for vulnerabilities
Answer: a
41. What is a Ransomware attack?
a) An attack that targets the website
b) An attack that encrypts data and then demands payment for its release
c) An attack that targets the database
Answer: b
42. What is a buffer overflow?
a) A software bug that occurs when a program writes more data to a buffer than it can hold
b) A security control that scans for vulnerabilities
c) A security control that limits access to specific resources based on user credentials
Answer: a
43. What is a cross-site scripting (XSS) attack?
a) An attack that targets the website
b) An attack that targets the database
c) An attack that targets users by injecting malicious code into a website
Answer: c
44. What is a digital signature?
a) An electronic signature that ensures the authenticity and integrity of a document or message
b) A security control that filters incoming or outgoing traffic based on predefined rules
c) A vulnerability in a system
Answer: a
45. What is session hijacking?
a) An attack that targets users by stealing their session ID or token
b) A security control that limits access to specific resources based on user credentials
c) A security control that scans for vulnerabilities
Answer: a
46. What is Multi-Factor Authentication (MFA)?
a) A security control that requires users to provide multiple forms of authentication before accessing resources
b) A security control that blocks traffic from known malicious sources
c) A security control that scans for vulnerabilities
Answer: a
47. What is a data leakage prevention (DLP) system?
a) A system that prevents sensitive data from leaving a network
b) A security control that filters incoming or outgoing traffic based on predefined rules
c) A vulnerability in a system
Answer: a
48. What is a VPN?
a) A virtual private network that provides secure remote access over the internet
b) A security control that limits access to resources based on user credentials
c) A security control that blocks traffic from specific IP addresses
Answer: a
49. What is a Security Information and Event Management (SIEM) system?
a) A system that aggregates and analyzes security alerts and logs from multiple sources
b) A security control that monitors network traffic
c) A security control that filters incoming or outgoing traffic based on predefined rules
Answer: a
50. What is a security risk assessment?
a) A process of evaluating and prioritizing potential security threats to an organization’s assets and systems
b) A security control that limits access to specific resources based on user credentials
c) A security control that encrypts data in transit
Answer: b
- Top 10 DevOps Trainers in the world - October 7, 2023
- What is Cookies and Why it is Used? - May 24, 2023
- TOP trends of transitions in TikTok - May 10, 2023