Practice & Reference · Exam Simulator

Exam Simulator

20 original practice questions, timed at 20 minutes, covering the real domains behind the three certifications on the Certifications page — the Certified DevSecOps Professional, the Certified Kubernetes Security Specialist, and AWS Certified Security – Specialty. These are original questions testing the same underlying knowledge, not reproductions of any vendor's actual exam content.

☺ Explain it like I'm 10

It's a practice fire drill, not the real fire. Nobody grades you and nothing is on your permanent record — you get a clock, twenty questions, and an honest score at the end so you know exactly what to study next.

🐢🦝Your hosts for this topic: Timmy the Turtle & Rocky the Raccoon — Timmy times you and checks every answer, Rocky reminds you that a real attacker doesn't care which question you found easy.

Before you start

☺ Like you're 10: One question at a time, twenty minutes on the clock, and you can go back and change an earlier answer before you submit.

20 questions, single-select, one at a time — use Previous and Next to move around before submitting, your answers are kept as you go. The 20-minute timer starts the moment you click start and auto-submits when it hits zero. Your best score is saved on this device only — nothing is sent anywhere.

Q1. "Shift-left" in DevSecOps means:

Security review happens only immediately before release. Security activities move as early into the SDLC as possible, in addition to production monitoring, not instead of it. Only the security team is responsible for security. Security tooling is removed from the pipeline to speed up releases.

Q2. In STRIDE, which category does "an attacker convincingly pretends to be someone else" fall under?

Tampering Spoofing Repudiation Elevation of privilege

Q3. What is the key practical difference between SAST and DAST?

They are the same technique with different names. SAST analyzes source code without running it; DAST attacks a running instance of the app black-box style. SAST only works on open-source dependencies. DAST requires access to the source code; SAST does not.

Q4. Why is a hardcoded secret in application source code dangerous even after it's later deleted from the latest commit?

It isn't dangerous once deleted from the latest commit. It persists in the git history and can still be found by anyone who can read that history. Secrets automatically expire after 24 hours. Git automatically encrypts all deleted content.

Q5. Which certification must you already hold, active and in good standing, before you're allowed to sit the CKS exam?

CKAD CKA (Certified Kubernetes Administrator) KCNA No certification is required — CKS has no prerequisite.

Q6. What is the main security benefit of a "distroless" container base image over a full general-purpose OS image?

It builds faster with no other benefit. A smaller attack surface — fewer packages, shells, and utilities an attacker could abuse if they get in. It automatically encrypts all traffic. It is required by every container registry.

Q7. What is the difference between a security "guardrail" and a security "gate"?

They mean exactly the same thing. A guardrail warns but allows an override; a gate blocks the action outright. A gate only applies to infrastructure; a guardrail only applies to code. A guardrail is manual; a gate is always automatic.

Q8. Under the cloud shared responsibility model, who is generally responsible for correctly configuring IAM policies on your own resources?

The cloud provider, always. The customer — the provider secures the infrastructure "of" the cloud, the customer secures what they put "in" it. No one — IAM is automatically secure by default on every cloud. A third-party auditor.

Q9. What does an SBOM (software bill of materials) let you do quickly when a new CVE is announced?

Automatically patch every affected system. Check whether any of your artifacts contain the affected component, without re-scanning everything from scratch. Encrypt your source code. Replace the need for any dependency scanning.

Q10. A dependency confusion attack works by:

Publishing a malicious public package with the same name as an internal private package, hoping the build pulls the public one by mistake. Encrypting a dependency so it can't be scanned. Deleting a dependency from a public registry. Renaming a container image tag.

Q11. In a NIST-style (PICERL) incident response lifecycle, which phase comes immediately after "Identify"?

Prepare Contain Lessons learned Recover

Q12. Why does a healthy security culture treat "I think I clicked a phishing link" as something to thank someone for, not punish?

Phishing isn't actually dangerous. Punishing honest reports makes people stop reporting, which is far worse than the original mistake. It's required by law in every jurisdiction. Only executives are allowed to report incidents.

Q13. What is the point of a "security champion" embedded in a product team, rather than routing everything through a central security team?

To replace the central security team entirely. To scale a small central team's reach — a local point of contact who helps triage findings without being a bottleneck. To handle payroll for the security team. Champions only exist in marketing organizations.

Q14. Why scan infrastructure-as-code definitions for misconfigurations before deploy, rather than only checking the running cloud environment afterward?

Pre-deploy scanning is impossible in practice. It catches the misconfiguration before it's ever deployed, which is cheaper and safer than remediating live infrastructure. It replaces the need for any runtime monitoring. It only works for AWS, never other clouds.

Q15. "Least privilege" as an IAM default means:

Every identity gets administrator access by default for convenience. An identity gets only the permissions it actually needs to do its job, nothing more. Only human users need IAM policies, not services. Permissions are granted once and never reviewed again.

Q16. What does signing a container image (e.g. with a Sigstore/cosign-class tool) let a consumer verify?

That the image contains no bugs. That the image genuinely came from the claimed builder/source and hasn't been tampered with since. That the image will run faster. That the image is automatically compliant with every regulation.

Q17. What is the main advantage of "compliance as code" (continuous automated evidence collection) over a once-a-year manual audit?

It eliminates the need for any audit at all. Evidence is collected continuously, so drift is caught quickly and audit time isn't a stressful scramble. It's required for every company regardless of size. It replaces the need for any human review, ever.

Q18. What's the difference between a CVE and a CVSS score?

They're the same thing. A CVE identifies a specific known vulnerability; a CVSS score rates that vulnerability's severity. CVSS identifies vulnerabilities; CVE rates their severity. CVE only applies to container images.

Q19. The core idea behind "zero trust" is:

Trust everything inside the corporate network perimeter by default. Never implicitly trust a request based on network location alone — verify identity and authorization every time, regardless of where it came from. Disable all authentication to reduce friction. Trust is established once at hire time and never re-checked.

Q20. Why is threat modeling most valuable when done at design time, before any code is written?

It's actually equally cheap at any stage. Fixing a design flaw on a whiteboard is far cheaper than fixing the same flaw after it's shipped to production. Code can't be threat modeled at all. Threat modeling is only useful for mobile apps.

⚠ What this is and isn't

A good score here means you know the underlying concepts, not that you're guaranteed to pass a specific vendor's exam — CKS and the CDP also test hands-on speed and real task execution, which no multiple-choice quiz can simulate. Pair this with real practice: run a scanner against a real repo and read the findings from the tooling landscape and checklist pages.

Exam Simulator

Before you start

Your results