Building a DevSecOps pipelineModule 1: Foundations and your lab repository

Checkpoint: foundations

Ten new questions across module 1: why the pipeline is the control point, the CI/CD threat model, and the lab repository's baseline.

Module checkpoint · 5 of 5 in this module5 of 26 in the courseFree preview: open to everyone

This lesson
QuestionsPass 7/10
Course26 items

In this module checkpoint you will

  • Check that you can place each security check in the right pipeline stage
  • Check that you can recognise poisoned pipeline execution, script injection and unsafe triggers
  • Check that you can explain the baseline choices in your lab repository

This checkpoint covers all of module 1. The questions are new: none repeat the lesson questions.

How to use it

  1. Answer every question before opening any explanation.
  2. Count how many you got right first time. The counter above the questions keeps track if JavaScript is on.
  3. For each miss, review the lesson below before moving on.
If you missed questions about Review
Pipeline stages, gates and reports, evidence (1, 2, 9, 10) Why the pipeline is the control point
OWASP CI/CD risks, untrusted input, triggers, STRIDE (3, 4, 5, 6) Threat modelling the pipeline itself
The lab repository’s baseline (7, 8) Lab: set up the course repository

Seven or more right first time means you are ready for module 2.

Key takeaways

  • Score yourself honestly: choose an answer before opening the explanation.
  • Seven or more right first time means you are ready for module 2.
  • For each miss, reread the lesson named in the table below before moving on.

Checkpoint questions

Answer all 10, then check them. You need 7 right to pass this module checkpoint and unlock the next one. Try as often as you like; after three tries the answers and explanations are shown. These are our own questions, written for this course.

  1. Your pipeline runs a container image scan after the image is already deployed to production. Which change follows the "earliest reliable stage" principle?
  2. A team's security job ends with semgrep scan || true. What is the effect?
  3. Which OWASP CI/CD risk best describes "a push to main deploys straight to production with no review or approval"?
  4. A privileged workflow_run workflow downloads the artifact from a pull request's build and executes a script found inside it. What is the problem?
  5. Which trigger runs a workflow from a fork's pull request with a read-only token and no access to repository secrets by default?
  6. In a STRIDE pass, "nobody can prove who approved last Friday's production deploy" is which threat?
  7. Why does the lab's smoke job install requirements.txt only, and not requirements-dev.txt?
  8. What is the main security reason to set the repository's default workflow permission to read-only, even though every workflow declares its own permissions block?
  9. Three months after a gate went live, the share of pull requests where people suppress or bypass it keeps rising. What does that most likely tell you?
  10. Which statement about pipeline evidence is accurate?

Courses are taught against the frameworks they name. That is alignment, not certification: no course is certified, approved or endorsed by NIST, the DoD, DISA, FedRAMP, the CMMC program or any other agency or standards body, and completing one does not make a system compliant.