Disclaimer:
Educational Use Only:
The website links provided are to be used strictly for educational and knowledge-gaining purposes only.
No Misuse:
Do not misuse the links or the information contained therein for any commercial, illegal, or unethical activities.
Respect for Websites and Businesses:
Respect the intellectual property and business interests of the websites and their owners. Do not attempt to alter, copy, or redistribute content without proper authorization.
Acknowledge Value of Knowledge:
Recognize and value the knowledge and resources shared by these websites. Use the information responsibly and ethically.
No Endorsement:
The provision of these links does not imply endorsement of the linked sites, their content, or their products and services. Users are responsible for evaluating the suitability and accuracy of the information.
User Responsibility:
By accessing these links, you agree to use the information at your own risk and to comply with all applicable laws and website terms of use.
- Continuous Delivery (CD) primarily aims to:
a. reduce cost of hardware
b. ensure software can be released reliably at any time
c. avoid writing tests
d. eliminate configuration management
Answer: b (Wikipedia) - What is the difference between Continuous Delivery and Continuous Deployment?
a. Continuous Delivery skips testing
b. Continuous Deployment is manual approval only
c. In Continuous Delivery deployment is manual; in Continuous Deployment it is automatic
d. They are the same
Answer: c (Sanfoundry) - In a secure CI/CD pipeline, what is a major risk linked to open-source scripts and dependencies?
a. Increase in disk usage
b. Malicious code injection or supply-chain attack
c. Slower compilation
d. Redundant unit tests
Answer: b (arXiv) - What is an “attack surface” in the context of CI/CD pipelines?
a. The UI layout of dashboards
b. Places where attackers may inject or exploit vulnerabilities in the pipeline
c. The number of developers in team
d. The number of tests run
Answer: b (arXiv) - Which principle helps committing code early that is not ready for end users in Continuous Delivery?
a. Big bang release
b. Feature toggles (feature flags)
c. Manual QA gates only
d. No branching
Answer: b (Wikipedia) - What is a deployment pipeline in CD practice?
a. A manual process to move binaries
b. A sequence of automated build, test, and deployment stages
c. A version control repository
d. A marketing plan
Answer: b (Wikipedia) - Which one is not part of a secure CD pipeline stage?
a. Static code analysis
b. Unit testing
c. Penetration testing
d. Ignoring security checks
Answer: d (secure pipelines include security checks) (arXiv) - What is meant by “Bring the pain forward” in CD?
a. Delay testing to the end
b. Address difficult issues early rather than late
c. Ignore failures
d. Push responsibility to other teams
Answer: b (Wikipedia) - In safety-critical domains, how should safety tests be treated in CD?
a. Only at final release
b. As part of every build and update safety analysis continuously
c. They can be skipped if time is short
d. Only manual testing
Answer: b (arXiv) - What is “continuous safety assessment” in DevOps/CD for safety-critical systems?
a. Doing safety checks once after all development
b. Automating safety assessment steps in the pipeline continuously
c. Omitting safety analysis
d. Outsourcing safety checks to third party only at end
Answer: b (arXiv) - Which challenge is cited in integrating security into CD pipelines?
a. No available tools
b. Increased time for builds and tests
c. No developers
d. No benefits
Answer: b (arXiv) - Which of the following is a mitigation against CI/CD pipeline script compromise?
a. Never review scripts
b. Use version control, code review, and secure configuration
c. Keep scripts in plaintext in production
d. Share secrets openly
Answer: b (arXiv) - What is “visibility” in the context of deployment pipelines?
a. Hiding logs from developers
b. Making build, deploy, test status visible to team members
c. Only operations team sees logs
d. Only final result is shown
Answer: b (Wikipedia) - What is “feedback” in deployment pipelines?
a. No notifications
b. Alerts and reports to developers when a pipeline step fails
c. Only monthly status meetings
d. Ignoring failures until production
Answer: b (Wikipedia) - Which tactic helps reduce risk of schema or database changes interfering with CD?
a. Rely exclusively on manual migrations
b. Use techniques like backward-compatible schema changes, gradual migrations
c. Always drop and recreate databases
d. Never change data models
Answer: b (Wikipedia) - Why is automating security tests in the CD pipeline important?
a. It slows pipeline
b. It ensures vulnerabilities are caught early and consistently
c. It is optional only for large teams
d. It is only needed at final delivery
Answer: b (arXiv) - What is a “single point of failure” risk in CI/CD pipeline infrastructure?
a. Having multiple redundant paths
b. Relying on one central script or service that, if compromised, breaks entire pipeline
c. Splitting pipeline across too many modules
d. Having no central control
Answer: b (arXiv) - What is a best practice for handling secrets in CI/CD?
a. Hard-code in code
b. Use secret vaults or secure credential management
c. Store in plain text environment variables shared publicly
d. Copy manually each environment
Answer: b (arXiv) - Which security threat can exploit misconfigured CI/CD configuration files (e.g. YAML)?
a. Social engineering
b. Attackers injecting malicious commands or workflows
c. Disk failure
d. Spam emails
Answer: b (arXiv) - What does “secure CI/CD configuration” typically include?
a. No access control
b. Role-based access, least privilege, approval gates
c. Allowing all users to modify pipeline
d. No review process
Answer: b (arXiv) - What is the role of code review in a secure CD pipeline?
a. Slowing down team
b. Catching logic/security flaws in pipeline or application code before merging
c. Not needed if tests pass
d. Only for UX code
Answer: b (arXiv) - How can the adoption of CD reduce risk in software delivery?
a. By enabling more frequent, smaller, and incremental releases, reducing blast radius of failures
b. By eliminating tests
c. By relying on manual deployment only
d. By skipping QA
Answer: a (Wikipedia) - What is the “pipeline as code” concept in CI/CD?
a. Ignore pipeline configuration
b. Defining pipeline configuration in code (e.g., YAML) versioned along with application
c. Hand-write pipeline in GUI only
d. Use a separate proprietary tool only
Answer: b (arXiv) - In the context of CD security, what is “least privilege”?
a. Giving full admin rights everywhere
b. Granting only the minimal permissions required to perform a task
c. No restrictions at all
d. Permissions escalate automatically
Answer: b (arXiv) - What is a “rollback” in CD?
a. Deployment of new version
b. Reverting to a previous known-good version when a failure occurs
c. Ignoring errors
d. Deleting the build pipeline
Answer: b (arXiv) - Which of the following helps in monitoring and alerting in CD for security?
a. No logs
b. Logging, anomaly detection, SIEM, alerting on suspicious pipeline behavior
c. Only manual inspection
d. Only after production
Answer: b (arXiv) - In secure CD, why is dependency scanning important?
a. To slow builds
b. To detect vulnerable open-source libraries or transitive dependencies early
c. To avoid versioning
d. To skip version control
Answer: b (arXiv) - Which approach helps reduce time of CI/CD pipelines while keeping security?
a. Running full security scans always
b. Incremental scanning, parallelization, caching, selective test execution
c. Removing tests
d. Serial execution of everything always
Answer: b (arXiv) - What is a “canary deployment” in CD?
a. Deploy new version to all users instantly
b. Deploy new version to a small subset of users first, then expand
c. Only manual deployment
d. Ignore feedback
Answer: b (Sanfoundry) - What is “blue-green deployment”?
a. Using colorful UI
b. Having two identical environments (blue and green), switch traffic from one to other to release with zero downtime
c. Deploy to one server only
d. Frequent full restarts
Answer: b (Sanfoundry) - What is “rolling deployment”?
a. Deploying to all nodes simultaneously
b. Updating small subsets gradually until all are updated
c. Manual only
d. Never changing anything
Answer: b (Sanfoundry) - How can “shift-left security” be applied in a CD pipeline?
a. Only test at end
b. Integrate security earlier (e.g., during dev, unit tests, static analysis)
c. Ignore developers
d. Only ops team does security
Answer: b (arXiv) - What does “secure infrastructure as code (IaC)” help prevent?
a. No effect
b. Infrastructure misconfigurations, drift, exposure of secrets
c. Faster builds
d. Less readability
Answer: b (arXiv) - Why is versioning pipeline and infrastructure configuration important?
a. Not important
b. To track changes, audit, rollback if needed
c. For fun only
d. Only binary code matters
Answer: b (arXiv) - What is the “pipeline integrity” concept?
a. Allowing arbitrary changes
b. Ensuring that pipeline definitions are protected, not tampered with
c. No checks on pipeline
d. Pipeline without authorization
Answer: b (arXiv) - What is a supply-chain attack in context of CD?
a. Attack on physical supply chain
b. Compromising a dependency or script in the build/deploy chain to inject malicious code
c. Attack on marketing
d. Data center outage
Answer: b (arXiv) - What is a threat model for CI/CD pipelines?
a. Only threats external to infrastructure
b. A structured analysis of potential threats to pipeline components (scripts, secrets, configs)
c. Ignoring possible attacks
d. Only consider DDoS
Answer: b (arXiv) - How can using immutable infrastructure help security in CD?
a. Doesn’t help
b. Ensures once deployed servers aren’t changed in place (replace rather than modify), reducing drift and tampering
c. Allows easy changes manually
d. Slows everything too much
Answer: b (arXiv) - What is meant by “security as code” in CI/CD pipelines?
a. No security
b. Managing security policies, tests, configurations in code, versioned, automatically enforced
c. Security only via manual tasks
d. Only pen testers do security
Answer: b (arXiv) - Which practice helps avoid credential leakage in CI/CD logs?
a. Logging all secrets
b. Masking or redacting secrets or using secure variables in logs
c. Never reviewing logs
d. Publishing full logs publicly
Answer: b (arXiv) - What is the role of dynamic application security testing (DAST) in CD?
a. No role
b. Running runtime tests against deployed or staging apps to detect vulnerabilities dynamically
c. Replace unit tests
d. Only manual scan once
Answer: b (arXiv) - What is the role of static application security testing (SAST) in CD?
a. Ignore code
b. Analyze source code or bytecode for vulnerabilities during build time
c. Only after deployment
d. At end-of-life only
Answer: b (arXiv) - Why is artifact signing important in CD?
a. Doesn’t matter
b. To verify authenticity and integrity of build artifacts before deployment
c. Only for docs
d. Only helpful in small systems
Answer: b (arXiv) - How does segregation of duties apply in CI/CD security?
a. Same person does everything
b. Separating roles (developer, operator, security) so one person cannot both push code and approve production changes without checks
c. No role separation
d. Only in small teams
Answer: b (arXiv) - What is “continuous compliance” in a CD pipeline?
a. No compliance
b. Automating checks to verify that deployments comply with regulatory, security, and policy requirements continuously
c. Only manual audits
d. Only post-mortem checks
Answer: b (arXiv) - Why is detecting configuration drift important in CD?
a. Not relevant
b. Drift could introduce inconsistencies or vulnerabilities between environments
c. Only matters after years
d. Only relevant to hardware
Answer: b (arXiv) - What is the “blast radius” concept in CD security?
a. The visual radius of UI
b. The extent of damage if a deployment or compromise goes wrong; smaller changes reduce blast radius
c. Only relevant to nuclear systems
d. Not applicable
Answer: b (arXiv) - How can “chaos engineering” help with CD security?
a. Break pipelines
b. Intentionally introducing failures to test system resilience and detect weaknesses
c. Only degrade performance
d. Not useful in CD
Answer: b (arXiv) - Why is continuous monitoring essential in a CD-driven ecosystem?
a. Only to measure performance
b. To detect anomalies, security incidents, pipeline misuse or intrusions in real time
c. Only for audit logs
d. Only after deployment
Answer: b (arXiv) - What is the “trust boundary” concept in CI/CD?
a. Only in software UI
b. Points where control or identity changes, e.g. from build server to environment, requiring validation or checks
c. Only in networks
d. Not relevant
Answer: b (arXiv)
