DevSecOps Interview Q&A
Q: Shift-left security — what does it mean?
Integrate security early in SDLC (development) rather than at the end (deployment). Security checks in IDE, pre-commit hooks, CI pipeline — not just in production monitoring.
Q: SAST vs DAST?
SAST (Static): analyze source code without running it. Tools: SonarQube, Semgrep, Bandit. Fast, catches code vulnerabilities. DAST (Dynamic): test running application. Tools: OWASP ZAP, Burp Suite. Finds runtime vulnerabilities.
Q: What is supply chain security?
Ensuring integrity of software and dependencies throughout the build/deploy pipeline. Tools: Sigstore/Cosign (image signing), SBOM (software bill of materials), Snyk (dependency scanning), Trivy (container scanning).
DevSecOps Interview Q&A
Q: What is the difference between SAST and DAST?
SAST (Static Application Security Testing): analyzes source code without running it. Fast, catches issues early in development. Tools: SonarQube, Semgrep, CodeQL. DAST (Dynamic Application Security Testing): tests the running application from outside (like an attacker). Finds runtime issues SAST misses. Tools: OWASP ZAP, Burp Suite. Both are needed for comprehensive coverage.
Q: What is an SBOM and why does it matter?
Software Bill of Materials: machine-readable inventory of all components in software (dependencies, libraries, versions, licenses). Formats: SPDX, CycloneDX. Why it matters: (1) quickly identify if your software uses a vulnerable component (e.g., Log4Shell), (2) license compliance, (3) regulatory requirement (US Executive Order 14028). Generated by Syft, Trivy, or build tools.
Q: How do you prevent secrets from reaching Git?
Pre-commit hooks: detect-secrets or git-secrets scan staged files before commit. CI gate: secret scanning step fails the pipeline. GitHub Advanced Security / GitLab Secret Detection scan history. If a secret is pushed: rotate it immediately (assume compromised), then remove from Git history (git filter-branch or BFG Repo Cleaner), audit access logs for misuse.
Q: What is supply chain security and why is it critical post-SolarWinds?
Attacks that compromise software before it reaches the target — through dependencies, build systems, or distribution. SolarWinds: attackers injected malicious code into the build pipeline; customers installed trojaned updates. Defenses: sign builds (Sigstore/Cosign), pin dependency versions with checksums, SBOM for component visibility, verify build provenance (SLSA framework), separate build environments.
Q: How do you implement least-privilege in Kubernetes?
RBAC: create ServiceAccounts per workload with only required permissions. Network Policy: default-deny, explicit allow for required paths. Security Context: set runAsNonRoot, readOnlyRootFilesystem, drop ALL capabilities, add only what's needed. PodSecurity Admission: enforce Baseline or Restricted policies per namespace. OPA/Kyverno: block privileged containers, enforce resource limits.