Security Engineering
DevSecOps Pipeline Security
9 practice questions. Free questions open a full answer guide; the rest unlock with Pro.
- What does it mean to 'shift security left' in a CI/CD pipeline, and what kinds of automated checks would you add to a build?
- Your builds pull hundreds of third-party packages from public registries on every run. Walk me through the supply-chain risks that introduces and how you'd contain them in the pipeline.Go Pro
- Why is OIDC workload identity federation better than storing a long-lived cloud access key in your CI system, and what changes when you adopt it?Go Pro
- Your pipeline runs security checks, but right now a failing scan just posts a warning and the build ships anyway. How do you turn pipeline security findings into real gates without grinding delivery to a halt, and how do you decide what blocks versus what only warns?Go Pro
- How would you add security scanning to a CI pipeline without turning it into a wall of noise that developers learn to ignore?Go Pro
- Your CI/CD pipelines pull in dozens of third-party build components — GitHub Actions, Jenkins plugins, CircleCI orbs — and most are referenced by a version tag. Why is that a supply-chain risk distinct from your application's own dependencies, and how would you lock it down?Go Pro
- What is software supply-chain security in the context of a build pipeline, and what are a couple of concrete steps to reduce that risk?Go Pro
- Your CI pipeline can read production secrets and deploy to prod. How do you keep the pipeline itself from becoming the easiest way into your infrastructure?Go Pro
- Why is it risky to store long-lived cloud access keys as CI secrets, and what's the modern alternative for letting a pipeline deploy to the cloud?Go Pro
Want questions matched to your role? Paste a job title, job description, or CV for a personalized set, or go Pro to unlock the full bank.