Disclaimer:
Educational Use Only:
The website links provided are to be used strictly for educational and knowledge-gaining purposes only.
No Misuse:
Do not misuse the links or the information contained therein for any commercial, illegal, or unethical activities.
Respect for Websites and Businesses:
Respect the intellectual property and business interests of the websites and their owners. Do not attempt to alter, copy, or redistribute content without proper authorization.
Acknowledge Value of Knowledge:
Recognize and value the knowledge and resources shared by these websites. Use the information responsibly and ethically.
No Endorsement:
The provision of these links does not imply endorsement of the linked sites, their content, or their products and services. Users are responsible for evaluating the suitability and accuracy of the information.
User Responsibility:
By accessing these links, you agree to use the information at your own risk and to comply with all applicable laws and website terms of use.
- What is the primary goal of Continuous Integration (CI) in a software development pipeline?
a. To automate deployment to production
b. To integrate code changes frequently and detect defects early
c. To eliminate the need for version control
d. To delay testing until final release
Correct answer: b. Integration of changes often helps catch integration issues early. (Wikipedia) - In a CI pipeline, which stage is typically responsible for compiling source code into executable artifacts?
a. Deployment
b. Monitoring
c. Build
d. Feedback
Correct answer: c. Build stage compiles and packages the application. (JetBrains) - Which of the following is not a standard component of a CI pipeline?
a. Automated testing
b. Version control integration
c. Manual deployment to production
d. Static code analysis
Correct answer: c. Manual deployment to production is not usually part of CI (it’s rather in CD). (Freshersnow) - Which one of these tools is commonly used for Continuous Integration / CI/CD automation?
a. Excel
b. Jenkins
c. Notepad
d. Paint
Correct answer: b. Jenkins is a widely used CI/CD automation server. (QA Automation Expert) - What is the difference between Continuous Delivery and Continuous Deployment?
a. Delivery includes manual approval before production, deployment is fully automated
b. Deployment includes manual approval, delivery is fully automated
c. They are exactly the same
d. Delivery only applies to mobile apps
Correct answer: a. Continuous Delivery requires a manual check before production, whereas Continuous Deployment automates that final step. (QA Automation Expert) - In the context of CI security, what is “secret management”?
a. Hiding code from developers
b. Storing and controlling access to credentials (API keys, tokens)
c. Obfuscating production code
d. Encrypting all source code
Correct answer: b. Proper secrets management helps prevent credential leaks in pipelines. (OWASP Cheat Sheet Series) - What is a risk in CI pipelines from malicious code injections or supply chain attacks?
a. The pipeline always blocks malicious payloads automatically
b. Attackers may insert malicious code into builds and distribute to users
c. There is no risk because CI only runs tests
d. Malicious code cannot run in CI environment
Correct answer: b. CI pipelines can be compromised and used to propagate malicious code (supply chain attacks). (OWASP Cheat Sheet Series) - Which of the following is a best practice for CI security?
a. Running pipelines with root privileges always
b. Use role-based access control for pipeline stages
c. Storing secrets in plaintext in version control
d. Disabling logging to avoid overhead
Correct answer: b. Use RBAC (role-based access control) to limit privileges. (OWASP Cheat Sheet Series) - What does “shift left” mean in DevSecOps / CI security?
a. Move testing and security earlier in the lifecycle
b. Move deployment to later stages
c. Delay integration until the end
d. Always do security last
Correct answer: a. “Shift left” means incorporate security (and testing) earlier in development pipeline. (CrowdStrike) - Which testing technique is suitable to integrate into CI pipelines to detect memory corruptions or undefined behavior?
a. Manual exploratory testing
b. Regression testing only
c. Fuzz testing / fuzzing
d. No testing
Correct answer: c. Fuzzing can be integrated in CI to detect unexpected errors. (arXiv) - In CI, if tests fail, what should ideally happen?
a. Automatically deploy anyway
b. Ignore failures and continue
c. Abort the pipeline and notify developers
d. Rollback production environment
Correct answer: c. CI should halt on test failures and alert developers. (Stack Overflow) - Which of the following is a known top risk in CI/CD pipelines, according to OWASP?
a. Unlimited scaling
b. Secrets exposure
c. Too many tests
d. Excessive branching
Correct answer: b. Secrets exposure in CI/CD is one of the top risks. (OWASP Cheat Sheet Series) - What is the role of artifact repositories in a CI/CD process?
a. To execute test scripts
b. To host production servers
c. To store build outputs and dependencies
d. To manage version control
Correct answer: c. Artifact repositories hold compiled artifacts, dependencies, etc. (JetBrains) - What does static code analysis in CI aim to do?
a. Execute runtime logic
b. Analyze code for vulnerabilities, style, errors without execution
c. Deploy code
d. Monitor performance after deployment
Correct answer: b. Static analysis inspects code without running it to find issues. (OWASP Cheat Sheet Series) - Which version control strategy helps reduce merge conflicts in CI?
a. Long-lived feature branches
b. Trunk-based development
c. No branching
d. Copying entire code for each feature
Correct answer: b. Trunk-based development encourages frequent integration, reducing conflicts. (Semaphore) - What is “pipeline as code”?
a. Writing deployment scripts manually for each environment
b. Storing pipeline configuration in version control (e.g. YAML)
c. Never using code in pipeline setup
d. Hardcoding pipeline logic in IDEs only
Correct answer: b. Pipeline as code implies storing pipeline definitions in code (version control). (about.gitlab.com) - Which of these is not a mitigation technique for CI pipeline attacks?
a. Immutable build agents
b. Signing build artifacts
c. Disabling logging
d. Scanning dependencies for vulnerabilities
Correct answer: c. Disabling logging reduces visibility and is not a mitigation. (OWASP Cheat Sheet Series) - Which principle assists in limiting the blast radius if a CI agent is compromised?
a. Full access to all systems
b. Principle of least privilege
c. Always use root access
d. Open network access
Correct answer: b. Using least privilege limits damage if a pipeline node is compromised. (OWASP Cheat Sheet Series) - What kind of security testing can you integrate in CI to find dependency vulnerabilities?
a. Penetration testing only at end
b. Software composition analysis (SCA)
c. Manual code review after deployment
d. No dependency checks
Correct answer: b. SCA tools help detect vulnerable libraries and dependencies. (SentinelOne) - Which statement describes “build only once” as a CI/CD best practice?
a. You build fresh artifacts per environment
b. Use the same artifact through test → staging → prod
c. Build twice for safety
d. Build at every environment stage
Correct answer: b. Using the same artifact ensures consistency across environments. (JetBrains) - In CI/CD, what is a “canary deployment”?
a. Testing on all users immediately
b. Rolling out changes to a small subset of users first
c. Deploying to development only
d. Immediate rollback
Correct answer: b. Canary means exposing the change to a small subset to monitor before full rollout. (JetBrains) - Why is mirroring the test environment to production recommended in CI?
a. To reduce resource usage
b. So tests more reliably reflect production behavior
c. Because it is cheaper
d. To avoid running tests
Correct answer: b. Mirroring ensures that tests detect real issues similar to production. (about.gitlab.com) - Which of the following is a challenge unique to integrating fuzzing into CI?
a. Fuzzing never finds bugs
b. Fuzzing is too deterministic
c. Fuzzing campaigns may take too long relative to CI speed
d. Fuzzing does not work in CI
Correct answer: c. Fuzzing can be time-consuming, so integrating it in fast CI is a challenge. (arXiv) - Which of these is a known threat vector in open-source CI pipelines?
a. Malicious plugin injection
b. Perfect security
c. Closed source only
d. No plugin use
Correct answer: a. Attackers may compromise CI scripts or plugins in open-source ecosystems. (arXiv) - What is integrity verification of build artifacts?
a. Allowing anyone to modify artifacts
b. Signing or hashing the artifact to ensure it is unchanged
c. Not using artifacts
d. Encrypting artifacts with no verification
Correct answer: b. Signing or hashing ensures artifacts are not tampered with. (OWASP Cheat Sheet Series) - What is the purpose of visibility and monitoring in CI security?
a. To reduce logs
b. To hide pipeline events
c. To detect anomalous behavior, intrusions, or misuse
d. To avoid accountability
Correct answer: c. Monitoring enables detection of suspicious or unauthorized changes. (OWASP Cheat Sheet Series) - In CI, what is meant by “keeping build times fast and simple”?
a. Minimizing unnecessary tasks so feedback is quick
b. Running all tests always
c. Doing manual builds
d. Combining all steps into one huge job
Correct answer: a. Faster feedback is critical; avoid overly long build pipelines. (about.gitlab.com) - Which of these is not a benefit of adopting CI/CD in general?
a. Faster feedback loops
b. Reduced manual errors
c. Increased release frequency
d. Complete elimination of security risks
Correct answer: d. CI/CD improves many things, but does not eliminate all security risks inherently. (QA Automation Expert) - What is “branch life” recommendation in CI environments?
a. Branches should live for months
b. Branches should be long-lived
c. Branches should be short-lived (hours to a day)
d. Never branch
Correct answer: c. Short-lived branches reduce integration conflicts. (Semaphore) - What is the key difference between testing in CI vs testing in CD?
a. CI runs unit and integration tests; CD runs end-to-end or deployment tests
b. CI does not run tests
c. CD is only for monitoring
d. They are identical
Correct answer: a. In CI you run isolated tests; in CD you run environment or system-wide tests. (Stack Overflow) - Which of the following is true about automating security checks in CI?
a. It slows down development irreparably
b. It helps detect vulnerabilities earlier
c. It replaces manual security entirely
d. It is only done after deployment
Correct answer: b. Automated security checks in CI help find vulnerabilities early. (SentinelOne) - What is “pipeline isolation” in CI security context?
a. Running all steps in a shared environment
b. Ensuring pipeline jobs run in isolated containers or sandboxed agents
c. Mixing environments
d. Ignoring isolation
Correct answer: b. Isolating pipeline jobs prevents lateral movement by attackers. (OWASP Cheat Sheet Series) - Which of these is a useful measure to protect source code in CI?
a. Open read/write for all
b. Enforce multi-factor authentication for code repo
c. No authentication
d. Weak passwords
Correct answer: b. MFA strengthens protection of the source repository. (SentinelOne) - What is “dependency pinning”?
a. Always use latest version of dependencies
b. Fixing dependencies to specific versions to avoid drift
c. Removing dependencies entirely
d. Randomizing dependencies
Correct answer: b. Pinning ensures reproducibility and prevents unexpected upgrades. (TechTarget) - How can you mitigate leaks of secrets via logs in CI?
a. Log everything, including secrets
b. Mask or redact secret values in logs
c. Disable logging entirely
d. Store secrets in code
Correct answer: b. Masking secrets in logs helps prevent exposure. (OWASP Cheat Sheet Series) - Which of the following helps ensure traceability in CI security?
a. No audit trails
b. Enabling logging and audit trails for pipeline actions
c. Clearing all historical records
d. Anonymous access only
Correct answer: b. Logs and audit trails enable tracing of actions in pipeline. (OWASP Cheat Sheet Series) - What is the advantage of using ephemeral build agents in CI?
a. They persist for months
b. They reset state between builds, reducing contamination risk
c. They never die
d. They share state with multiple jobs
Correct answer: b. Ephemeral agents reduce leftover artifacts and contaminations. (OWASP Cheat Sheet Series) - In secure CI pipelines, what is “least privilege for build agents”?
a. Agents can access everything
b. Agents have only necessary permissions, no more
c. Agents run as root always
d. Agents share credentials
Correct answer: b. Agents should be granted minimum necessary permissions. (OWASP Cheat Sheet Series) - Which of these is a reason why CI pipelines become high-value targets for attackers?
a. They rarely access sensitive systems
b. They often have high privileges and access credentials
c. They run offline
d. They have no credentials
Correct answer: b. CI systems often manage deployment, credentials, etc., making them attractive targets. (OWASP Cheat Sheet Series) - What is “provisioning infrastructure as code (IaC)” in CI/CD context?
a. Manually configuring servers
b. Using code (scripts) to define and provision infrastructure
c. Avoiding automation
d. Leaving infrastructure static
Correct answer: b. IaC automates infrastructure setup via code. (TechTarget) - What is the purpose of “code review gates” in CI?
a. Allowing code without checks
b. Ensuring peer review before merge
c. Deleting code automatically
d. Ignoring developers’ changes
Correct answer: b. Code review gates enforce review before merging changes. (ProProfs) - Which of the following is a practice for securing CI agent communication?
a. Use unencrypted channels
b. Use TLS/SSL for communications between components
c. Hardcode credentials in plain text
d. No authentication between components
Correct answer: b. TLS/SSL helps protect communication integrity. (OWASP Cheat Sheet Series) - What is a “pipeline trigger”?
a. A person manually starting pipeline
b. An event (e.g. commit) that automatically starts a pipeline
c. A random timer only
d. No triggers exist
Correct answer: b. Triggers (like Git pushes) launch pipelines automatically. (InterviewBit) - In CI security, why should secrets not be stored in version control?
a. Because version control is too fast
b. Secrets in version control risk exposure and replay attacks
c. Secrets should always be public
d. Version control cannot store text
Correct answer: b. Version control storage of secrets is risky; better use secret vaults. (OWASP Cheat Sheet Series) - What is dependency scanning frequency recommended in secure CI pipelines?
a. Never
b. Only once a year
c. On every pipeline run
d. Only in production
Correct answer: c. Scanning dependencies on every run helps catch vulnerabilities early. (SentinelOne) - How does multi-factor authentication (MFA) enhance CI security?
a. Makes login slower
b. Adds an extra factor (e.g. OTP) so stolen credentials alone are less effective
c. Replaces passwords entirely
d. Does not help
Correct answer: b. MFA helps mitigate credential theft risks. (CrowdStrike) - Which of these practices helps in disaster recovery for CI servers?
a. No backups
b. Regular backups of pipeline configuration and state
c. Only local logs
d. Disabling backups
Correct answer: b. Backing up pipeline configs, agent states helps recover from failures. (OWASP Cheat Sheet Series) - What is the purpose of “chain of trust” in CI security?
a. Trust nothing
b. Verifying each component authenticity (e.g. signed binaries)
c. Open trust always
d. Removing all signatures
Correct answer: b. Chain of trust ensures each component or artifact is validated. (OWASP Cheat Sheet Series) - Which of the following can help secure plugin ecosystems used by CI tools?
a. Allow any plugin without review
b. Use only trusted, signed plugins and review them
c. No plugin use
d. Use random third-party plugins
Correct answer: b. Only approved, signed plugins should be allowed to reduce risk. (OWASP Cheat Sheet Series) - What is a useful metric to measure CI pipeline performance/security?
a. Number of developers
b. Mean time to recovery (MTTR) for broken builds
c. Alphabetical order of commit messages
d. Number of skipped tests only
Correct answer: b. MTTR indicates how quickly pipeline issues get resolved. (JetBrains)
