SAFe® 5 DevOps Certification SAFe 5 DevOps Security and Compliance — Questions and Answers
Question 1: What does DevSecOps mean in the SAFe framework?
- Integrating security practices throughout the entire DevOps pipeline rather than as a separate phase (Correct answer)
- A separate security team that reviews code after deployment
- Security testing performed only during the final release
- Development, security, and operations as three separate teams
Correct answer: Integrating security practices throughout the entire DevOps pipeline rather than as a separate phase
DevSecOps integrates security throughout the development lifecycle — from design through deployment — making security a shared responsibility embedded in every pipeline stage rather than a gate at the end.
Question 2: What is shift-left security in the context of SAFe DevOps?
- Moving security testing and considerations earlier in the development lifecycle (Correct answer)
- Shifting security responsibilities to the left-hand team
- Moving security servers to a different data center
- Delegating security to external consultants
Correct answer: Moving security testing and considerations earlier in the development lifecycle
Shift-left security means incorporating security practices (static analysis, dependency scanning, threat modeling) early in the development process, catching vulnerabilities when they're cheaper and easier to fix.
Question 3: What is the purpose of static application security testing (SAST) in the CI/CD pipeline?
- To analyze source code for security vulnerabilities without executing the application (Correct answer)
- To test the application under simulated attack conditions
- To scan network traffic for intrusions
- To verify user authentication credentials
Correct answer: To analyze source code for security vulnerabilities without executing the application
SAST tools analyze source code, bytecode, or binary code to identify security vulnerabilities (SQL injection, XSS, buffer overflows) without running the application, enabling early detection during development.
Question 4: How should secrets management be handled in a DevOps pipeline?
- Using dedicated secrets management tools (Vault, AWS Secrets Manager) with encrypted storage and access controls (Correct answer)
- Storing passwords in source code comments
- Sharing credentials via email or chat
- Hardcoding API keys in configuration files
Correct answer: Using dedicated secrets management tools (Vault, AWS Secrets Manager) with encrypted storage and access controls
Secrets (passwords, API keys, certificates) should be managed through dedicated tools that provide encrypted storage, access control, audit logging, automatic rotation, and dynamic secret generation.
Question 5: What is compliance as code in SAFe DevOps?
- Automating compliance verification through code that enforces policies and generates audit evidence (Correct answer)
- Writing compliance documents in programming languages
- Replacing compliance officers with software developers
- Using spreadsheets to track compliance status
Correct answer: Automating compliance verification through code that enforces policies and generates audit evidence
Compliance as code automates the verification and enforcement of regulatory and organizational policies through executable code, automated tests, and continuous monitoring, producing auditable evidence at every pipeline stage.
Question 6: What is the role of container scanning in DevSecOps?
- Analyzing container images for known vulnerabilities, malware, and misconfigurations before deployment (Correct answer)
- Scanning shipping containers at ports
- Monitoring container orchestration platform performance
- Testing container application functionality
Correct answer: Analyzing container images for known vulnerabilities, malware, and misconfigurations before deployment
Container scanning examines container images and their layers for known CVEs, outdated packages, embedded secrets, and configuration issues before they are deployed to production environments.
SAFe® 5 DevOps Certification SAFe 5 DevOps Security and Compliance
What does DevSecOps mean in the SAFe framework?