Disclaimer:
Educational Use Only:
The website links provided are to be used strictly for educational and knowledge-gaining purposes only.
No Misuse:
Do not misuse the links or the information contained therein for any commercial, illegal, or unethical activities.
Respect for Websites and Businesses:
Respect the intellectual property and business interests of the websites and their owners. Do not attempt to alter, copy, or redistribute content without proper authorization.
Acknowledge Value of Knowledge:
Recognize and value the knowledge and resources shared by these websites. Use the information responsibly and ethically.
No Endorsement:
The provision of these links does not imply endorsement of the linked sites, their content, or their products and services. Users are responsible for evaluating the suitability and accuracy of the information.
User Responsibility:
By accessing these links, you agree to use the information at your own risk and to comply with all applicable laws and website terms of use.
- In the context of CI/CD, continuous deployment means:
a. Code is manually approved before deployment
b. Automated deployment of every passing change to production
c. Only releases after a manual QA gate
d. Deployment only during scheduled windows
Answer: b (Wikipedia) - Which of the following best distinguishes continuous deployment from continuous delivery?
a. Deployment is manual in both
b. Continuous delivery always exposes changes to end users immediately
c. Continuous deployment automates the release to production for all validated changes
d. Continuous delivery never uses automated tests
Answer: c (Wikipedia) - What is a major security risk in CI/CD pipelines?
a. Stale commit history
b. Hardcoding secrets in pipeline scripts
c. Too many test cases
d. Frequent refactoring
Answer: b (Razorops) - The “shift-left” security paradigm refers to:
a. Moving deployments to weekends
b. Incorporating security practices early in development phases
c. Reducing security testing entirely
d. Shifting responsibility to operations team only
Answer: b (Razorops) - Which tool type is commonly integrated into CI/CD for static security scanning?
a. DAST
b. WAF
c. SAST
d. SIEM
Answer: c (Razorops) - Dynamic Application Security Testing (DAST) is best applied at which stage?
a. Before coding
b. During build
c. Against the running application in staging
d. After deployment to production only
Answer: c (Razorops) - What is a Software Bill of Materials (SBOM) useful for in deployment pipelines?
a. Tracking user stories
b. Managing release dates
c. Enumerating all software components and dependencies
d. Defining UI layouts
Answer: c (Razorops) - Which of the following mitigates dependency vulnerabilities in CI/CD?
a. Using latest version with no checks
b. Ignoring version conflicts
c. Using tools like OWASP Dependency-Check or Snyk
d. Removing all external libraries
Answer: c (Razorops) - A blue-green deployment strategy helps primarily with:
a. Reducing unit test time
b. Zero-downtime deployment and rollback
c. Managing database schema changes
d. Version control branching
Answer: b (Wikipedia) - Which metric is part of DORA metrics relevant to CD?
a. Mean Time Between Failures (MTBF)
b. Deployment Frequency
c. Memory usage per build
d. Lines of code per commit
Answer: b (Wikipedia) - What is the primary objective of securing the CI/CD pipeline?
a. Only speed
b. Only code formatting
c. Preventing misuse or compromise of deployment infrastructure
d. Avoiding code reviews
Answer: c (arXiv) - Which vulnerability arises from misconfigured pipeline permissions?
a. Cross-site scripting
b. Privilege escalation within pipeline
c. SQL injection
d. Timing attack
Answer: b (arXiv) - What is an attack surface in CI/CD pipelines?
a. The UI color scheme
b. The parts of pipeline that can be targeted by attackers
c. The commit history length
d. The number of test cases
Answer: b (arXiv) - One common CI/CD security best practice is:
a. Checking secrets into version control
b. Storing secrets in plain text environment variables
c. Using a secrets management system (e.g., Vault)
d. Giving full admin rights to pipeline agents
Answer: c (Razorops) - What is “canary release” in a deployment context?
a. Deploying to all users at once
b. Deploying initial version only to a small subset and monitoring
c. Deploying only to blue environment
d. Manual rollback only
Answer: b (Wikipedia) - Which is a disadvantage or challenge in continuous deployment adoption?
a. Manual approval overhead
b. Lack of fast feedback loops
c. Increased risk if pipeline is insecure
d. No ability to roll back
Answer: c (arXiv) - Why is image manipulation a concern in cloud CI/CD?
a. It slows builds
b. Attackers may tamper container images to inject malicious code
c. It improves availability
d. It reduces storage usage
Answer: b (arXiv) - What role does anomaly detection play in CI/CD security?
a. Ignore pipeline logs
b. Monitor for unusual activities or deviations in pipeline behavior
c. Speed up builds
d. Replace unit tests
Answer: b (arXiv) - Which of the following is true about continuous integration?
a. Developers merge code rarely
b. It aims to integrate changes frequently with automated builds and tests
c. It avoids automated testing
d. It delays feedback till later stages
Answer: b (Wikipedia) - Which concept helps reduce blast radius of an exploited pipeline?
a. Single, monolithic pipeline for all services
b. Shared credentials across pipelines
c. Isolation and least privilege design of pipeline steps
d. Full privileges to all components
Answer: c (arXiv) - Which of these is a recommended practice in CD pipeline security?
a. Allowing pipeline to run arbitrary user code unchecked
b. Validating pipeline configuration as code (linting)
c. Not versioning pipeline definitions
d. Podman usage only
Answer: b (arXiv) - Which stage is the best place to perform dependency vulnerability scanning?
a. Deployment to production only
b. After release
c. During build or pre-deployment
d. Never
Answer: c (Razorops) - To protect against pipeline replay attacks, you would use:
a. Insecure tokens
b. No audit logs
c. Nonces or short-lived tokens with integrity checks
d. Hardcoded passwords
Answer: c (common security practice) - What is the impact of a compromised CI/CD agent?
a. No risk
b. Attacker can inject malicious changes into production
c. Only test failures
d. Only documentation changes
Answer: b (arXiv) - Which of the following helps enforce consistency in pipeline definitions?
a. Storing pipeline definitions ad hoc
b. Keeping pipeline definitions in version control (pipeline as code)
c. Allowing manual edits in GUI only
d. No versioning
Answer: b (arXiv) - What is the principle of least privilege in CI/CD contexts?
a. Grant all permissions to pipelines
b. Grant only minimal needed permissions to each pipeline component
c. Avoid access control
d. Use root for all operations
Answer: b (arXiv) - How can you validate container images in a deployment pipeline?
a. Skip checks
b. Use image signing and verification (e.g. Docker Content Trust, Notary)
c. Accept any image version
d. Trust public images always
Answer: b (industry best practice) - Which of following is a standard practice to rollback in continuous deployment?
a. Manual code revert only
b. DNS switch back (blue-green) or rollback scripts
c. No rollback capability
d. Rely only on user complaints
Answer: b (Wikipedia) - What is the threat of supply chain attacks in CI/CD?
a. Slower pipelines
b. Attackers tampering with third-party dependencies, tools, or build systems
c. More storage usage
d. Less testing
Answer: b (arXiv) - Why is auditing and logging crucial in CI/CD pipelines?
a. To slow things down
b. Detect and trace malicious or anomalous actions in the pipeline
c. Just for billing
d. To confuse operations
Answer: b (security best practice) - What is “pipeline poisoning” in CI/CD?
a. Deploying clean code
b. Introducing malicious steps or commands into pipeline definitions
c. Running extra tests
d. Using more disk space
Answer: b (common security attack) - What is “robust rollforward” in deployment?
a. No safety net
b. Always roll back only
c. Ability to continue in face of failures (resilient forward recovery)
d. Manual intervention only
Answer: c (design pattern) - How to reduce insider threat risk in CD pipeline?
a. One person has full control
b. Access controls, separation of duties, code review
c. No reviews
d. Shared accounts
Answer: b (security practice) - Which technique helps in reducing the risk of exposing secrets?
a. Plaintext in logs
b. Masking or redaction of secrets in logs
c. No masking
d. Print secrets to console
Answer: b (best practice) - What is a good practice for testing in continuous deployment?
a. Only manual testing
b. Automate unit, integration, and security tests in pipeline
c. Skip tests
d. Run tests only once per month
Answer: b (key to CD) - Which of these is used to prevent tampering with pipeline artifacts?
a. No validation
b. Artifact signing and hash verification
c. Trust everything blindly
d. No checksums
Answer: b (secure artifact practice) - What does “immutable infrastructure” refer to in CD security?
a. Modify servers in place
b. Replace servers rather than patching
c. Live patching always
d. No redeployment
Answer: b (common paradigm) - Which of the following is a drawback if the pipeline is too monolithic?
a. Easier security audits
b. Single point of failure or compromise
c. Clear isolation
d. Scalability improved
Answer: b (risk) - Why is versioning of configurations (infrastructure as code) important in CD?
a. Not important
b. Enables traceability, rollback, auditing
c. Makes pipelines slower only
d. Reduces modularity
Answer: b (best practice) - What is “continuous validation” in CD?
a. Only running build
b. Continuous automated tests, scanning, checks before deployment
c. Validate only at release time
d. No validation
Answer: b (concept in CD pipelines) - Which of the following helps to minimize damage from compromised pipeline?
a. Using long-lived tokens everywhere
b. Frequent credential rotation, short-lived tokens
c. No credential rotation
d. Sharing credentials across pipelines
Answer: b (security best practice) - How is container registry security relevant to CD pipelines?
a. Irrelevant
b. A compromised registry can allow malicious images to be deployed
c. Only for storage
d. Only for documentation
Answer: b (supply chain concern) - Why is environment isolation (dev, test, staging, prod) important in CD?
a. To confuse teams
b. Prevent cross-environment contamination and reduce risk
c. Use the same environment always
d. No isolation
Answer: b (security principle) - What is “progressive delivery” in deployment?
a. Deploy all at once
b. Techniques like canaries, feature flags, dark launches to gradually increase exposure
c. No control
d. Only manual releases
Answer: b (modern deployment practice) - Why is pipeline scalability a security concern?
a. More throughput always safer
b. Attackers may exploit scaling features to run malicious operations
c. No risk
d. Slower builds only
Answer: b (scaling risk) - Which of the following is a method to detect unauthorized changes in pipeline scripts?
a. No verification
b. Cryptographic signing or checksums plus alerts
c. Trust manual edits blindly
d. Allow any changes
Answer: b (security measure) - What is the role of least common mechanism in CD security?
a. Share mechanisms across subsystems
b. Avoid sharing mechanisms; minimize shared interfaces to reduce coupling and attack surface
c. Use one mechanism for everything
d. Ignore separation
Answer: b (security principle) - Which challenge is specific to CI/CD security in cloud settings?
a. No challenges unique to cloud
b. Image manipulation, unauthorized access, weak authentication in pipelines in cloud contexts
c. Only hardware faults
d. Lack of version control
Answer: b (arXiv) - What is a good defense against “pipeline as code” injection vulnerabilities?
a. Allow arbitrary user input
b. Validate and lint pipeline definitions, restrict ingestion sources
c. No checking
d. Use untrusted external definitions
Answer: b (secure infrastructure as code practice) - Which emerging technique enhances security monitoring in CD pipelines?
a. Ignoring metrics
b. AI-based anomaly detection on pipeline and network behaviors
c. Manual log reading only
d. Removing logs
Answer: b (arXiv)
Key source references:
- The systematic literature review of continuous integration, delivery, deployment, tools, challenges and practices (arXiv)
- The SLR focusing on CI/CD for secure cloud computing (arXiv)
- The study on security threats and attack surfaces in CI/CD pipelines (arXiv)
- Blog “Top 50 CICD Security Phase Interview Question and Answers” covering CI/CD security concerns, secret handling, SAST/DAST etc. (Razorops)
- Wikipedia definitions of CI/CD, continuous deployment, continuous delivery, blue-green deployment (Wikipedia)
