Embedding Federated Security Testing Across the SDLC Quiz

What does “DevSecOps” add to the DevOps process?

• Better UI

• Performance Testing

• Security Practices

• Marketing Automation

What is the goal of shifting security “left” in the SDLC?

• Delay testing until production

• Move security tasks earlier in development

• Eliminate the need for security tools

• Let operations handle security alone

Which type of testing analyzes source code without running it?

• DAST

• RASP

• SAST

• Penetration Testing

What does SCA primarily focus on?

• Infrastructure vulnerabilities

• Network performance

• Open-source library risks

• User behavior

What kind of secrets does secret scanning try to detect?

• Gossip about the app

• Database structures

• API keys and credentials

• Code logic bugs

What is a real-world risk of exposing secrets like tokens or API keys in public repositories?

• Slower application performance

• Unauthorized access to systems and dat

• Code formatting issues

• Higher cloud storage costs

What is the main benefit of federated security testing?

• It centralizes all security responsibilities in one team

• It delays security testing until the release phase

• It enables security testing at multiple stages by multiple teams

• It only applies to containerized workloads

Which tool would detect a misconfigured IAM role in a Terraform file?

• DAST

• SAST

• IaC Scanner

• RASP

RASP tools work by...

• Scanning the source code

• Protecting the application during runtime

• Performing regression tests

• Blocking code merges in Git

Why is fixing vulnerabilities earlier in the SDLC cheaper?

• Developers get bonuses for early fixes

• It avoids redesigning or re-testing late-stage code

• Security teams charge more later

• There’s no difference in cost