Practice & Reference · Flashcards
Flashcards
38 cards drawn from every module in this course, front to back. The front holds a question, the back holds the answer — click or tap a card to flip it, and search to jump straight to a topic.
☺ Explain it like I'm 10
Rereading a page feels like studying because the words look familiar, but recognizing a fact and pulling it back out of memory unprompted are two different skills — humming along to a song versus singing it with no music playing. A flashcard forces the second skill: you have to commit to an answer before you're allowed to check it. A few minutes most days beats one long cram session, because each successful recall makes the next one cheaper — that's spaced practice, and it's the whole reason this deck exists instead of a plain list of facts.
Foundations
What do the five letters of CALMS stand for?
Tap / Enter to flip →
Answer
Culture, Automation, Lean, Measurement, Sharing — DevSecOps runs security through all five instead of treating it as a separate track outside them.
Foundations
Define shift-left precisely — and name the common misreading of it.
Tap / Enter to flip →
Answer
Moving security activities as early into the SDLC as possible, because a defect is cheapest to fix the moment it's introduced. It does not mean security work stops after design — runtime monitoring in production still has a place on the timeline.
Foundations
What is the Rugged Manifesto, and who introduced it?
Tap / Enter to flip →
Answer
A 2010 manifesto from Josh Corman and application-security collaborators arguing software should be engineered to withstand hostile conditions — attackers, misuse, scale — not just pass a functional test suite.
Foundations
Name all six STRIDE threat categories, in order.
Tap / Enter to flip →
Answer
Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege.
Foundations
In STRIDE, which security property does Tampering violate? Give an example.
Tap / Enter to flip →
Answer
Integrity — for example, a build artifact fetched over plain HTTP with no checksum, letting an attacker substitute it in transit.
Foundations
What is a trust boundary, and why does STRIDE analysis concentrate on the points where one is crossed?
Tap / Enter to flip →
Answer
A point where data crosses from one level of trust to another — e.g. an anonymous user into your app. STRIDE concentrates there because a threat confined entirely within a zone you control end to end is a far smaller concern than one where a less-trusted actor sits on one side.
Foundations
How do attack trees complement a STRIDE-over-DFD pass, and who formalized attack trees?
Tap / Enter to flip →
Answer
STRIDE-over-DFD is breadth-first, surfacing threats across every element. Attack trees, formalized by Bruce Schneier in the late 1990s, are depth-first — decomposing one high-severity attacker goal into concrete steps, useful for reasoning about the cheapest viable path to that goal.
Foundations
What's the practical difference between OWASP SAMM and BSIMM?
Tap / Enter to flip →
Answer
SAMM is prescriptive — it defines maturity levels an organization should work toward. BSIMM is descriptive — it reports what real organizations actually do, based on repeated measurement, so a team can benchmark against actual industry practice.
Securing the Pipeline
Why doesn't deleting a secret in a later git commit actually remove the exposure?
Tap / Enter to flip →
Answer
Git stores every commit as an immutable object — the secret still exists in earlier commit objects, in any clone or fork made before the deletion, and in CI caches or mirrors. The only reliable fix is to treat the credential as compromised and rotate it.
Securing the Pipeline
Name four secrets managers you'll see most in production, and what they give you that a checked-in
.env file can't.Tap / Enter to flip →
Answer
HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, and Google Secret Manager — centralized access policy, a full audit log of every read, and encryption plus versioning built for the job.
Securing the Pipeline
Why does a short-lived, dynamically issued credential limit damage more than a static one with the same permissions?
Tap / Enter to flip →
Answer
Its TTL bounds the exposure window automatically — a credential with, say, a 15-minute TTL expires on its own if it leaks, instead of staying valid until someone notices and manually revokes it, which can take weeks.
Securing the Pipeline
What does SAST analyze, and name four tools that do it.
Tap / Enter to flip →
Answer
Source code, bytecode, or binaries, without executing them — pattern-matching against known-dangerous constructs like string-built SQL queries or hardcoded keys. Semgrep, CodeQL, SonarQube, and Checkmarx.
Securing the Pipeline
What does DAST catch that SAST structurally cannot, and name its two most common tools?
Tap / Enter to flip →
Answer
It attacks a running instance from the outside, catching runtime and configuration issues invisible in source — missing security headers, a cookie missing the Secure flag, an auth bypass only visible when middleware interacts at runtime. OWASP ZAP and Burp Suite.
Securing the Pipeline
Why does SCA matter as much as it does for a typical modern codebase?
Tap / Enter to flip →
Answer
Because industry composition studies (Synopsys's OSSRA report is the most-cited) consistently find 70-90%+ of a typical commercial application's code, by line count, is open-source dependencies — a scanner that only analyzes code the team wrote is missing most of what ships.
Securing the Pipeline
What does the SLSA framework describe, and what does Build L3 require that L1 doesn't?
Tap / Enter to flip →
Answer
A maturity model for how much you can trust that an artifact was built the way its source claims. Build L1 just requires a scripted, automated build with basic provenance; Build L3 requires the build platform to isolate workflows from each other so one compromised job can't forge convincing provenance for another artifact.
Securing the Pipeline
Why does an ephemeral, single-use build runner reduce risk compared to a long-lived self-hosted one?
Tap / Enter to flip →
Answer
An attacker who compromises a build during execution has no persistent place to plant a backdoor, cache stolen credentials, or poison future runs — the environment is destroyed after each job.
Securing the Pipeline
What does the distroless / scratch base-image pattern strip out, and why does that reduce risk beyond just image size?
Tap / Enter to flip →
Answer
No shell, no package manager, no coreutils — fewer installed packages means fewer components a CVE can ever apply to, and an attacker who gains code execution has far fewer tools available to escalate or pivot.
Securing the Pipeline
What is an SBOM, which two formats are standard, and why does it matter the moment a new CVE like Log4Shell is disclosed?
Tap / Enter to flip →
Answer
A Software Bill of Materials — a structured inventory of every component and version in a built artifact, typically SPDX or CycloneDX. With SBOMs generated at build time and indexed centrally, "which of our services use this library" becomes a query returning minutes, not a days-long manual audit.
Cloud & Infrastructure Security
What does the evidence say is the leading cause of cloud security incidents?
Tap / Enter to flip →
Answer
Misconfiguration — not a novel zero-day. A public storage bucket, a security group open to 0.0.0.0/0, encryption left off by default. All three exist as reviewable text in IaC before they ever exist in a live account.
Cloud & Infrastructure Security
What is policy as code, and what's the reference implementation most tools converge on?
Tap / Enter to flip →
Answer
Expressing organizational security rules as versioned, executable code instead of a wiki page — evaluated automatically against structured input and returning an allow/deny decision. Open Policy Agent (OPA) with its Rego language.
Cloud & Infrastructure Security
Soft guardrail vs. hard gate — what's the difference, and when do you use each?
Tap / Enter to flip →
Answer
A soft guardrail warns but lets an engineer proceed, usually with justification. A hard gate blocks the pipeline outright with no path forward short of an explicit exception. Use guardrails for rules with legitimate exceptions or an unproven false-positive rate; hard gates for violations with no legitimate exception at all.
Cloud & Infrastructure Security
What is configuration drift, and what catches it that pre-deploy scanning can't?
Tap / Enter to flip →
Answer
The live state of a cloud environment diverging from the IaC definition that's supposed to describe it — e.g. a security group rule added manually during an incident and never removed. Pre-deploy scanning can't catch it; only ongoing drift detection re-evaluating live state can.
Cloud & Infrastructure Security
In the cloud shared responsibility model, what stays the provider's job, and what shifts to the customer?
Tap / Enter to flip →
Answer
The provider secures the underlying infrastructure — physical hardware, host virtualization, and (for managed services) the runtime. The customer stays responsible for data, identity and access configuration, and workload-level controls; exactly where the line falls shifts with IaaS vs. PaaS vs. SaaS, but "security of the cloud" vs. "security in the cloud" is the dividing line.
Cloud & Infrastructure Security
What's the practical difference between a SOC 2 Type I and Type II report, and which do enterprise buyers usually insist on?
Tap / Enter to flip →
Answer
Type I attests controls were designed appropriately as of one date; Type II attests those controls actually operated effectively over an observation window, typically 6-12 months. Buyers usually insist on Type II, because Type I only proves a control existed on paper for a day.
Cloud & Infrastructure Security
Under GDPR, how long do you have to notify the relevant supervisory authority after discovering a personal data breach?
Tap / Enter to flip →
Answer
72 hours from becoming aware of the breach.
Response & Culture
Spell out all six phases of PICERL.
Tap / Enter to flip →
Answer
Prepare, Identify, Contain, Eradicate, Recover, Lessons learned — the SANS Institute's incident-handling model, cyclical rather than linear.
Response & Culture
How do PICERL's six phases map onto NIST SP 800-61's four?
Tap / Enter to flip →
Answer
Prepare → Preparation. Identify → Detection & Analysis. Contain, Eradicate, and Recover → Containment, Eradication & Recovery. Lessons learned → Post-Incident Activity.
Response & Culture
Per RFC 3227's order-of-volatility principle, what evidence should you collect first during a breach?
Tap / Enter to flip →
Answer
The most volatile state first — CPU registers and cache, routing tables and ARP cache, running processes, and RAM — before anything less volatile like disk, backups, or archival logs, because volatile state disappears the moment power or process state changes.
Response & Culture
Why is killing a compromised container the moment you spot it usually a mistake?
Tap / Enter to flip →
Answer
It feels like containment, but it also wipes the process list, open network connections, and any memory-resident payload before anyone captures them. Cordon and isolate at the network layer first, snapshot disk and memory, and only then terminate the workload.
Response & Culture
When does deliberately delaying isolation of a compromised host make sense, and when does it not?
Tap / Enter to flip →
Answer
It can make sense for reconnaissance-stage access with a contained blast radius, to trace lateral movement before shutting the door. It stops making sense the moment there's active, irreversible loss — ransomware mid-encryption or confirmed data exfiltration calls for immediate isolation.
Response & Culture
What ratio of security engineers to developers is commonly cited, and what problem does the security champions model solve for it?
Tap / Enter to flip →
Answer
Somewhere between 1:100 and 1:400. A central team can't review every pull request or design meeting at that ratio, so one embedded, trained champion per product team handles local triage and translates policy into decisions the team actually understands.
Response & Culture
Under a blameless model, what question should an incident review ask instead of "whose fault was this"?
Tap / Enter to flip →
Answer
What systemic or process gap let the failure happen, and what control would catch the next occurrence — punishing the reporter doesn't undo the mistake, it just teaches everyone else watching to stay quiet next time.
Practice & Reference
Semgrep, CodeQL, SonarQube, Checkmarx — what category of tool, and what approach do they share?
Tap / Enter to flip →
Answer
SAST tools — they all build an abstract syntax tree or control-flow graph from source and pattern-match against known-dangerous constructs, without ever executing the code.
Practice & Reference
OWASP ZAP and Burp Suite — what category, and what's their defining trait?
Tap / Enter to flip →
Answer
DAST tools — they treat the application as a black box with no source access, crawling a running instance and throwing malicious input at every field and header they find.
Practice & Reference
Snyk, Dependabot, OWASP Dependency-Check, Trivy — what category of scanning do they perform?
Tap / Enter to flip →
Answer
SCA — software composition analysis, scanning dependency manifests against vulnerability databases like the NVD, the GitHub Advisory Database, and OSV.
Practice & Reference
Checkov, tfsec, Terrascan — what do these scan, and at what point in the workflow should they run?
Tap / Enter to flip →
Answer
Infrastructure-as-code definitions (Terraform plans, CloudFormation templates) for known-bad patterns — ideally as a required pipeline check before
terraform apply ever runs, not as a one-off manual pass.Practice & Reference
Gitleaks, TruffleHog, detect-secrets — where do these typically run, and why isn't that placement sufficient on its own?
Tap / Enter to flip →
Answer
As pre-commit hooks, scanning a diff for credential-shaped strings before a commit is even created — the cheapest place to stop a leak, but skippable with
--no-verify, so the same scanning has to run again as a mandatory gate later in CI.Practice & Reference
What does Sigstore's cosign do, and what role does Rekor play alongside it?
Tap / Enter to flip →
Answer
cosign signs a container image's digest with a private key — or "keylessly" via an OIDC identity — so a puller can verify it wasn't tampered with. Rekor is the public transparency log that records what was signed and when, so the record isn't just a private key check nobody else can audit.