Question 1

What is DevSecOps?

Accepted Answer

DevSecOps is the practice of integrating security into software delivery and operations rather than treating it as a separate late-stage activity. It brings security controls into development, CI/CD, infrastructure, and runtime operations.

The real idea is that security should be continuous and shared, not bolted on at the end. In interviews, strong answers connect DevSecOps to automation, collaboration, and reducing risk without slowing delivery unnecessarily.

Question 2

What does shift-left security mean?

Accepted Answer

Shift-left security means moving security checks earlier in the software lifecycle, such as during coding, pull requests, dependency management, and CI pipelines.

This helps teams catch issues when they are cheaper and easier to fix. It also reduces the chance that security becomes a bottleneck right before release.

Question 3

What is the difference between SAST and DAST?

Accepted Answer

SAST, or Static Application Security Testing, analyzes source code or build artifacts without running the application. DAST, or Dynamic Application Security Testing, tests a running application from the outside to find exploitable behavior.

SAST is useful early in development, while DAST is useful closer to runtime validation. A good answer also mentions that neither replaces the other; they cover different parts of the security picture.

Question 4

Why scan container images?

Accepted Answer

Container image scanning helps identify known vulnerabilities, outdated packages, weak base images, and risky components before deployment.

This matters because container images often inherit risk from the base image and installed dependencies. A strong answer should mention that scanning is useful, but patching, rebuilding, and minimizing image contents are just as important.

Question 5

What is an SBOM, and why is it useful?

Accepted Answer

An SBOM, or Software Bill of Materials, is an inventory of the components and dependencies used in a software artifact.

It improves supply-chain visibility and helps teams respond faster when a vulnerable library or component is discovered. Instead of guessing where a dependency is used, teams can identify affected systems more quickly.

Question 6

How should secrets be handled in repositories and pipelines?

Accepted Answer

Secrets should never be committed to repositories in plaintext. They should be stored in secret managers or secure CI variable systems and injected at runtime or deployment time.

Good answers also mention secret scanning, access controls, short-lived credentials, and rotation. The point is not only to hide secrets, but to reduce exposure and make misuse easier to detect.

Question 7

What is least privilege in practice?

Accepted Answer

Least privilege means identities and workloads should get only the permissions they need to perform their tasks and nothing more.

In practice, this means avoiding wildcard admin access, separating human and machine identities, reviewing permissions regularly, and narrowing privileges by environment, service, and role. It is one of the most important core principles in cloud and DevOps security.

Question 8

What is policy as code?

Accepted Answer

Policy as code means expressing security or compliance rules in machine-readable form so they can be validated automatically in CI/CD and infrastructure workflows.

This is powerful because it scales governance. Instead of relying on manual reviews alone, teams can automatically block infrastructure that violates rules such as public storage buckets, missing encryption, or overly permissive IAM policies.

Question 9

What is the difference between compliance and security?

Accepted Answer

Security is about reducing real risk to systems and data. Compliance is about meeting the requirements of a framework, standard, or regulation such as SOC 2, ISO 27001, PCI DSS, or HIPAA.

The two overlap, but they are not identical. A company can pass an audit and still be insecure, or improve security in ways not directly mapped to a framework. Strong candidates understand that compliance should support security, not replace it.

Question 10

Why is dependency and supply-chain security important?

Accepted Answer

Modern applications depend on many third-party libraries, packages, and build tools. If one of those components is compromised or vulnerable, it can affect the final system.

This is why teams scan dependencies, pin versions, verify provenance where possible, and control what is allowed into builds. Supply-chain risk is a major DevSecOps topic because trust boundaries extend far beyond your own source code.

Question 11

How do you prepare for security audits?

Accepted Answer

I would maintain evidence of controls, keep access reviews and change histories, ensure policies are followed in practice, and collect documentation that maps technical safeguards to audit requirements.

A mature answer also mentions automation. Audit preparation becomes much easier when logs, approvals, scans, access policies, and pipeline checks already produce reliable evidence continuously rather than being assembled manually at the last minute.

Question 12

What does a mature DevSecOps program look like?

Accepted Answer

A mature DevSecOps program includes secure coding practices, automated scanning, strong IAM, secret management, image and dependency controls, policy enforcement, monitoring, and a clear incident response process.

The key is balance. Mature programs reduce risk in a repeatable way without creating constant friction for engineers. Security becomes part of the delivery system, not a separate gatekeeper function.

Question 13

What is threat modeling?

Accepted Answer

Threat modeling is the process of identifying potential attackers, attack paths, assets, and mitigations for a system before or during development.

It is useful because it helps teams think proactively about risk instead of reacting only after vulnerabilities are found. Strong answers connect threat modeling to architecture, data flow, and trust boundaries.

Question 14

What is a secret scanning tool used for?

Accepted Answer

Secret scanning tools detect credentials or sensitive tokens accidentally committed to repositories, pull requests, or build outputs.

They are important because accidental exposure is common and often high impact. Detection helps, but mature teams also pair it with prevention and fast rotation procedures.

Question 15

What is runtime security in DevSecOps?

Accepted Answer

Runtime security focuses on detecting and responding to suspicious behavior after an application or workload is already running.

This complements earlier controls like code scanning or image scanning. A good answer shows that security is needed across the full lifecycle, not only before deployment.

Question 16

Why are least-privilege service accounts important?

Accepted Answer

Service accounts often connect automation, applications, and infrastructure. If they are overprivileged, a compromise can spread quickly.

Keeping them tightly scoped reduces blast radius and helps contain mistakes or attacks. This is especially important in cloud-native environments with many machine identities.

Question 17

What is the principle of defense in depth?

Accepted Answer

Defense in depth means using multiple layers of security controls so that one failed control does not immediately lead to a major compromise.

Examples include IAM, network policies, secret management, scanning, monitoring, and approval workflows. Strong answers explain that no single control is perfect.

Question 18

Why are security baselines important?

Accepted Answer

Security baselines define minimum acceptable configurations for systems, such as logging enabled, encryption required, hardened images, or restricted ports.

They help standardize security across teams and environments. Without baselines, security quality often becomes inconsistent and dependent on individual memory.

Question 19

What is a vulnerability management process?

Accepted Answer

Vulnerability management is the ongoing process of identifying, prioritizing, remediating, and tracking security weaknesses over time.

This matters because scanning alone is not enough. Organizations need ownership, prioritization, patch strategy, and evidence that important findings are actually addressed.

Question 20

Why is patch management important in DevSecOps?

Accepted Answer

Patch management helps ensure operating systems, packages, images, and dependencies do not remain exposed to known vulnerabilities longer than necessary.

Good answers mention that patching must be systematic and tested. Rushing patches without validation can create outages, but ignoring patches creates obvious security debt.

Question 21

What is compliance evidence?

Accepted Answer

Compliance evidence is the documentation, logs, reports, approvals, and technical records used to show that controls are operating as required.

The strongest DevSecOps programs generate evidence continuously through automation rather than collecting it manually right before an audit.

Question 22

What are security gates in a CI/CD pipeline?

Accepted Answer

Security gates are checks that block promotion when certain security conditions are not met, such as critical vulnerabilities, policy violations, or missing approvals.

They help enforce consistent standards, but mature teams tune them carefully to focus on real risk instead of generating excessive friction or false positives.

Question 23

Why is inventory important in security programs?

Accepted Answer

You cannot protect what you do not know exists. Asset inventory helps teams understand what systems, services, repositories, identities, and dependencies need protection.

Good answers connect inventory to ownership, patching, risk tracking, and incident response. Security visibility starts with knowing the estate.

Question 24

How do you balance developer velocity with security?

Accepted Answer

I would automate as much of security as possible, shift checks earlier, reduce false positives, and focus human review where risk is highest.

The goal is not to remove friction entirely, but to make secure delivery the easiest normal path. Strong candidates show they understand both engineering speed and risk management.

Question 25

What is the difference between authentication and authorization?

Accepted Answer

Authentication verifies who someone or something is, while authorization determines what they are allowed to do.

This distinction is foundational in security design. Many breaches are not failures of identity proof but failures of overly broad authorization.

Question 26

Why are audit logs important?

Accepted Answer

Audit logs provide a record of important actions such as access changes, deployments, policy changes, and administrative activity.

They support investigations, compliance evidence, and accountability. Strong answers also mention that logs must be protected and retained appropriately to remain trustworthy.

Question 27

How do you respond when a leaked credential is discovered?

Accepted Answer

I would revoke or rotate the credential immediately, assess where it was exposed, search for misuse, review related access, and document the incident and follow-up actions.

The important point is speed and containment. A mature answer also includes prevention steps such as scanning, narrower scopes, and improved secret handling patterns.

Question 28

What is zero trust in practical terms?

Accepted Answer

Zero trust is the idea that systems should not assume trust based only on network location. Access should be explicitly verified and continuously constrained.

In practice, that means strong identity, device and context checks, segmented access, least privilege, and better visibility. It is more of a design model than a single product.

Question 29

Why are secure defaults important?

Accepted Answer

Secure defaults reduce risk by making the safer configuration the standard starting point instead of relying on every engineer to remember every control manually.

They are powerful because they scale across teams. Good security programs reduce the need for perfect human behavior.

Question 30

What is risk acceptance in security governance?

Accepted Answer

Risk acceptance means acknowledging a known security risk and explicitly deciding to live with it for a period of time, usually with documented rationale and ownership.

This matters because not every issue can be fixed immediately. Mature governance requires visibility and accountability for those decisions.

DevSecOps & Compliance

1. What is DevSecOps?

2. What does shift-left security mean?

3. What is the difference between SAST and DAST?

4. Why scan container images?

5. What is an SBOM, and why is it useful?

6. How should secrets be handled in repositories and pipelines?

7. What is least privilege in practice?

8. What is policy as code?

9. What is the difference between compliance and security?

10. Why is dependency and supply-chain security important?

11. How do you prepare for security audits?

12. What does a mature DevSecOps program look like?

13. What is threat modeling?

14. What is a secret scanning tool used for?

15. What is runtime security in DevSecOps?

16. Why are least-privilege service accounts important?

17. What is the principle of defense in depth?

18. Why are security baselines important?

19. What is a vulnerability management process?

20. Why is patch management important in DevSecOps?

21. What is compliance evidence?

22. What are security gates in a CI/CD pipeline?

23. Why is inventory important in security programs?

24. How do you balance developer velocity with security?

25. What is the difference between authentication and authorization?

26. Why are audit logs important?

27. How do you respond when a leaked credential is discovered?

28. What is zero trust in practical terms?

29. Why are secure defaults important?

30. What is risk acceptance in security governance?