DevSecOps & Secure SDLC Exam Prep

They test judgement in short scenarios more than tool knowledge. Typical items ask at which stage a flaw can be detected EARLIEST, which control is BEST, what to do FIRST, or what MOST LIKELY explains a finding. Formats differ between exams, so always check the official objectives.

Place each control where its input first exists. SAST and secret scanning read source, so they run on the pull request. SCA reads the lockfile and also runs on the pull request, plus nightly. Image scanning needs the built image, so it runs at build. DAST needs a running application, so it runs against staging.

Revoke or rotate the credential first, because anyone may already have copied it, and review logs for its use since the commit. Removing it from git history, making the repository private and adding secret scanning are follow-up steps that do not invalidate the leaked value.

No. A signature proves who produced the artifact and that it has not changed, not that it is free of vulnerabilities. It also only helps if something verifies the signature at deployment, for example an admission policy that rejects unsigned images.

SCA analyses the third-party dependencies your application declares, usually from lockfiles. Container image scanning analyses the built image and also finds vulnerable operating-system packages inherited from the base image. Most pipelines need both.

It depends on experience. People who already ship code through CI/CD weekly may manage in about four focused weeks; eight weeks is a balanced default; newcomers to development or security should plan around twelve weeks with practice questions and spaced review.