DevOps Engineer
DevSecOps and secrets questions
130 questions on DevSecOps and secrets for devops engineers, easiest first.
Easy 37
- Why use a .dockerignore fileeasy
- Are Kubernetes Secrets encryptedeasy
- What Trivy scans foreasy
- Why use Vault dynamic secretseasy
- What SAST doeseasy
- What DAST doeseasy
- What SCA tools findeasy
- What "shift left" meanseasy
- What an SBOM iseasy
- CVE vs CVSSeasy
- Least privilege for a CI tokeneasy
- Catching secrets before commiteasy
- Keeping secrets out of CI logseasy
- Why use a minimal base imageeasy
- What Dependabot or Renovate doeasy
- What secret rotation meanseasy
- Why require a second reviewereasy
- Severity for a CVSS scoreeasy
- When to scan container imageseasy
- What STRIDE is used foreasy
- What the OWASP Top 10 iseasy
- Protecting CI and registry accountseasy
- Why keep pipeline audit logseasy
- In transit vs at resteasy
- AGPL library in a SaaS producteasy
- What push protection doeseasy
- What IaC scanning catcheseasy
- ENV password in a Dockerfileeasy
- What a security champion doeseasy
- Zero trust in one lineeasy
- Starting from default denyeasy
- Reducing attack surfaceeasy
- Defence in deptheasy
- Standing admin access to productioneasy
- What OpenSSF Scorecard checkseasy
- Passwords in a Helm values fileeasy
- Keeping a password in the repo safelyeasy
Medium 51
- Why use multi-stage buildsmedium
- Cloud credentials in CImedium
- Sensitive outputs and statemedium
- Secrets empty on fork PRsmedium
- Running builds on the Jenkins controllermedium
- Running containers as non-rootmedium
- Cloud key pushed to a public repomedium
- Limiting GITHUB_TOKEN rightsmedium
- Pinning third-party actionsmedium
- Spotting a typosquatted packagemedium
- Dependency confusionmedium
- Why CI uses npm cimedium
- Triaging 300 SCA findingsmedium
- Handling a SAST false positivemedium
- API key found in Git historymedium
- Pod rejected by the restricted profilemedium
- Why use a read-only root filesystemmedium
- Linux capabilities for a web appmedium
- Risk of privileged: truemedium
- Mounting the Docker socketmedium
- How Pods log in to Vaultmedium
- What External Secrets Operator doesmedium
- KMS encryption for Kubernetes Secretsmedium
- RBAC that leaks every Secretmedium
- Private registry token during buildmedium
- CVE with a fixed version availablemedium
- Blocking :latest at the clustermedium
- Secret leaked despite maskingmedium
- Using secrets in a Jenkinsfilemedium
- GitLab variable for prod deploys onlymedium
- Rotating an API key without downtimemedium
- Cloud access without key filesmedium
- Encrypting fields without holding keysmedium
- Mounting secrets straight from a vaultmedium
- Pods that never call the APImedium
- Modern ServiceAccount tokensmedium
- Who can read etcdmedium
- A sensible image scan gatemedium
- Detecting a shell in a containermedium
- Admins skipping branch protectionmedium
- Who must review pipeline changesmedium
- Policy checks on a Terraform planmedium
- Attaching provenance and SBOM at buildmedium
- The two main SBOM formatsmedium
- Focusing audit on shipped codemedium
- Trusting a deploy webhookmedium
- What a signed commit provesmedium
- Who read a Kubernetes Secretmedium
- Attaching a signed SBOM to an imagemedium
- Proving a binary came from your workflowmedium
- Blocking public buckets automaticallymedium
Hard 42
- Same tag, different imagehard
- Risky GitHub Actions triggerhard
- Provider checksum mismatch in CIhard
- Secrets in a GitOps repohard
- Only deploy images built by CIhard
- Policy webhook takes down deployshard
- Deleted secret still in the imagehard
- App fails every hour on DB authhard
- Prioritising beyond CVSShard
- What SLSA Build L3 addshard
- How keyless cosign signing workshard
- Answering a customer scan with VEXhard
- Self-hosted runners on a public repohard
- Cache poisoning in a release buildhard
- Injection through an issue titlehard
- Stopping overwritten release tagshard
- Secrets as env vars vs fileshard
- Running customer code in containershard
- CVE in a package the app never useshard
- Revoking leaked dynamic DB credentialshard
- Trusted registries and digests onlyhard
- Installing a CLI with curl | bashhard
- Where to run an active DAST scanhard
- Answering "are we affected?" fasthard
- Lesson from the xz utils backdoorhard
- Auto-merging dependency bumpshard
- Why reproducible builds matterhard
- The secret zero problemhard
- Vault restarts at 3 a.m.hard
- Rotating the Secrets encryption keyhard
- Stopping exfiltration from runnershard
- Worms spread through install scriptshard
- Pod create rights reveal Secretshard
- Designing break-glass accesshard
- Workflows approving pull requestshard
- SBOM from source vs from the imagehard
- A signing key was leakedhard
- Pods stealing the node cloud rolehard
- Privilege escalation via PassRolehard
- Limiting where Pods can connecthard
- A DB password that never hits statehard
- Vault password in a pipelinehard