Skip to content

Commit 9bfdac8

Browse files
D3OneD3One
authored
Update DevSecOps Practice QA.md
1 parent 0152490 commit 9bfdac8

1 file changed

Lines changed: 259 additions & 0 deletions

File tree

‎DevSecOps/DevSecOps Practice QA.md‎

Lines changed: 259 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,260 @@
1+
# Senior/Lead DevSecOps — Technical Interview Question Bank
12

3+
**How to use this set:** 36 questions total — **22 theory (≈60%)** and **14 practical (≈40%)**. Each item includes brief **“What good answers include”** guidance. Practical tasks test commands/flags, config review, and policy-as-code. Tailor difficulty by drilling deeper on any prompt.
4+
5+
---
6+
7+
## A) Theory — Strategy, Supply Chain, Cloud/K8s/App, Governance (22)
8+
9+
1. **DevSecOps vs AppSec vs Product Security**
10+
**What good answers include:** DevSecOps = security in delivery pipelines and operations; AppSec = secure code & app-layer testing; Product Security = end-to-end product ecosystem (device/firmware/cloud/support), broader than code/pipeline.
11+
12+
2. **NIST SSDF (SP 800-218) in CI/CD**
13+
**What good answers include:** Map practices (PO/GV/PS/RE) to controls: signed commits, branch protection, SCA/SAST gates, SBOM generation, provenance attestations, coordinated disclosure readiness.
14+
15+
3. **SLSA levels (1–4) — why they matter**
16+
**What good answers include:** Provenance, build integrity (hermetic/reproducible builds), two-person review, authenticated builders; defend against build pipeline tampering and artifact substitution.
17+
18+
4. **SBOM + VEX — when and how**
19+
**What good answers include:** SPDX/CycloneDX for SBOM; VEX to declare exploitability; use to prioritize patching and inform customers/PSIRT.
20+
21+
5. **Threat modeling in agile**
22+
**What good answers include:** Lightweight, iterative (per epic); DFD + abuse cases; STRIDE; integrate findings into backlog with acceptance criteria.
23+
24+
6. **Secrets management & short-lived credentials**
25+
**What good answers include:** Vault/KMS, OIDC workload identity for CI jobs, no static keys in repos/vars, rotation, scope/TTL, secrets scanning in pre-commit/CI.
26+
27+
7. **OIDC workload identity vs stored cloud keys in CI**
28+
**What good answers include:** OIDC issues short-lived, aud/iss-bound tokens; eliminates static secrets; enforce least privilege via cloud trust policies.
29+
30+
8. **Dependency confusion & typosquatting — countermeasures**
31+
**What good answers include:** Private registries/scopes, pinning/lockfiles, allow-lists, checksum verification, registry mirrors, package provenance (Sigstore).
32+
33+
9. **Policy-as-Code (OPA/Rego, Conftest) — placement points**
34+
**What good answers include:** In PR checks (IaC scanning), admission controllers (K8s), and org policies (cloud SCPs); treat violations as gates with waivers.
35+
36+
10. **Cloud shared responsibility & identity-first security**
37+
**What good answers include:** Distinguish IaaS/PaaS/SaaS duties; emphasize IAM least privilege, permission boundaries, SCPs, JIT elevation, logging.
38+
39+
11. **Kubernetes defense-in-depth**
40+
**What good answers include:** PSA (Baseline/Restricted), RBAC least-priv, NetworkPolicies (default-deny), admission (Kyverno/Gatekeeper), runtime (eBPF), image provenance, secrets externalization.
41+
42+
12. **Container hardening fundamentals**
43+
**What good answers include:** Non-root user, drop capabilities, read-only rootfs, minimal base, seccomp/AppArmor/SELinux, multi-stage builds.
44+
45+
13. **API security essentials**
46+
**What good answers include:** Authn/OIDC, fine-grained authz (BOLA/IDOR prevention), schema validation, rate limiting, token handling (short TTL, rotation).
47+
48+
14. **IAM privilege-escalation patterns**
49+
**What good answers include:** Wildcards (`*`), pass-role, policy-document editing, STS mis-constraints; mitigations with Conditions, boundaries, graph analysis (CIEM).
50+
51+
15. **Vulnerability triage beyond CVSS**
52+
**What good answers include:** Reachability, exploitability in your environment (KEV), compensating controls, exposure window, business impact.
53+
54+
16. **Exception/risk acceptance with compensating controls**
55+
**What good answers include:** Time-boxed waivers, owner, review date, alternative controls, monitored metrics.
56+
57+
17. **IR lifecycle (NIST 800-61) in cloud-native orgs**
58+
**What good answers include:** Prep → Detect/Analyze → Contain/Eradicate/Recover → Post-Incident; evidence retention (signed logs, chain-of-custody), playbooks.
59+
60+
18. **Ransomware in cloud/K8s**
61+
**What good answers include:** Immutable backups (3-2-1), least-priv storage, network segmentation, MFA, JIT admin, EDR/XDR, recovery drills.
62+
63+
19. **Data protection & crypto key separation**
64+
**What good answers include:** Envelope encryption, CMKs in KMS/HSM, separate roles (key admin vs data admin), rotation, audit of key use.
65+
66+
20. **Safe deployment strategies**
67+
**What good answers include:** Blue-green, canary, feature flags, progressive rollout with automatic rollback and SLO guards.
68+
69+
21. **Compliance mapping (SOC 2/ISO 27001) for DevSecOps**
70+
**What good answers include:** Evidence: pipeline controls, change mgmt, access reviews, incident runbooks, vulnerability SLAs, logging, supplier risk.
71+
72+
22. **Program metrics that matter**
73+
**What good answers include:** Leading/lagging: p95 patch time, % signed artifacts, % services with Restricted PSA, secrets findings trend, MTTD/MTTR, exposure reduction.
74+
75+
---
76+
77+
## B) Practical — Hands-on Tasks with Commands/Configs (14)
78+
79+
> Tip: Give a terminal or repo snippet; ask for exact commands/flags and a corrected config.
80+
81+
1. **K8s RBAC sanity check**
82+
**Prompt:** Verify whether the default service account in namespace `shop` can list Secrets.
83+
**Expected commands/flags:**
84+
`kubectl auth can-i list secrets --as=system:serviceaccount:shop:default -n shop`
85+
**Good answer:** Should be **no** by default; if yes, show `Role`/`RoleBinding` to restrict.
86+
87+
2. **NetworkPolicy: allow app → db only**
88+
**Prompt:** Write a policy in ns `shop` so pods with `app=db` only receive TCP/5432 from pods with `app=api`.
89+
**Solution (snippet):**
90+
91+
```yaml
92+
apiVersion: networking.k8s.io/v1
93+
kind: NetworkPolicy
94+
metadata: {name: db-allow-api, namespace: shop}
95+
spec:
96+
podSelector: {matchLabels: {app: db}}
97+
policyTypes: [Ingress]
98+
ingress:
99+
- from:
100+
- podSelector: {matchLabels: {app: api}}
101+
ports: [{protocol: TCP, port: 5432}]
102+
```
103+
104+
3. **Pod Security Admission fix**
105+
**Prompt:** This pod violates Restricted:
106+
107+
```yaml
108+
securityContext: {privileged: true, runAsUser: 0}
109+
```
110+
111+
**Ask:** Make it compliant.
112+
**Good answer:**
113+
114+
```yaml
115+
securityContext:
116+
allowPrivilegeEscalation: false
117+
runAsNonRoot: true
118+
runAsUser: 1000
119+
seccompProfile: {type: RuntimeDefault}
120+
capabilities: {drop: ["ALL"]}
121+
```
122+
123+
4. **Image scanning with severity gating**
124+
**Prompt:** Fail the build if critical/high vulns found; ignore unfixed.
125+
**Expected commands:**
126+
`trivy image --severity CRITICAL,HIGH --ignore-unfixed --exit-code 1 myapp:sha-abc123`
127+
128+
5. **Cosign signing & verification (keyless and key)**
129+
**Prompt:** Sign container image `registry.example.com/team/app:1.2.3` and verify at deploy.
130+
**Expected commands:**
131+
132+
* Keyless (OIDC): `cosign sign registry.example.com/team/app:1.2.3`
133+
Verify: `cosign verify --certificate-identity-regexp 'github.com/.+/.+' --certificate-oidc-issuer https://token.actions.githubusercontent.com registry.example.com/team/app:1.2.3`
134+
* With key: `cosign generate-key-pair`; `cosign sign --key cosign.key ...`; verify with `--key cosign.pub`.
135+
136+
6. **Terraform security scan & fix**
137+
**Prompt:** Detect and fix open ingress in this AWS SG:
138+
139+
```hcl
140+
ingress { from_port=22 to_port=22 protocol="tcp" cidr_blocks=["0.0.0.0/0"] }
141+
```
142+
143+
**Expected commands:** `checkov -d .` or `tfsec .`
144+
**Fix:** Restrict to office CIDR, use `aws_security_group_rule`, add description and tags.
145+
146+
7. **OPA/Rego via Conftest**
147+
**Prompt:** Write a policy to fail if any Terraform AWS Security Group allows `0.0.0.0/0`.
148+
**Sketch:**
149+
150+
```rego
151+
package terraform.security
152+
153+
deny[msg] {
154+
input.resource_types[_] == "aws_security_group"
155+
rule := input.resources[_]
156+
rule.ingress[_].cidr_blocks[_] == "0.0.0.0/0"
157+
msg := sprintf("Open ingress on %s", [rule.name])
158+
}
159+
```
160+
161+
**Run:** `conftest test .`
162+
163+
8. **Git commit signing & verification**
164+
**Prompt:** Enforce signed commits and verify a PR.
165+
**Expected commands:**
166+
`git config --global commit.gpgsign true`
167+
`git verify-commit <sha>` or `git verify-tag <tag>`; branch protection “Require signed commits”.
168+
169+
9. **GitHub Actions secret exposure fix**
170+
**Prompt:** Workflow uses `pull_request_target` and exposes `${{ secrets.CLOUD_KEY }}` to forks. Secure it.
171+
**Good answer:** Use `pull_request` (not target), `permissions: read-all` by default, disallow secrets on forks via `if: github.event.pull_request.head.repo.fork == false`, or use OIDC to mint short-lived creds with environment protection rules.
172+
173+
10. **OpenSSL/ECDSA CSR generation**
174+
**Prompt:** Create a P-256 key and CSR with SANs `api.example.com` and `api.int`.
175+
**Expected commands:**
176+
177+
```bash
178+
openssl req -new -newkey ec:<(openssl ecparam -name prime256v1) -nodes \
179+
-keyout api.key -out api.csr -subj "/CN=api.example.com" \
180+
-addext "subjectAltName=DNS:api.example.com,DNS:api.int"
181+
```
182+
183+
11. **Kyverno: require signed images**
184+
**Prompt:** Admission policy to enforce Cosign signature.
185+
**Sketch:**
186+
187+
```yaml
188+
apiVersion: kyverno.io/v1
189+
kind: ClusterPolicy
190+
metadata: {name: require-signed-images}
191+
spec:
192+
rules:
193+
- name: verify-signature
194+
match: {resources: {kinds: ["Pod"]}}
195+
verifyImages:
196+
- image: "registry.example.com/*"
197+
attestations:
198+
- type: cosign
199+
```
200+
201+
12. **Dockerfile hardening**
202+
**Prompt:** Fix:
203+
204+
```dockerfile
205+
FROM node:18
206+
USER root
207+
RUN npm i -g serve
208+
COPY . /app
209+
WORKDIR /app
210+
CMD ["serve","-p","80"]
211+
```
212+
213+
**Good answer:**
214+
215+
* Use minimal base (distroless/alpine when appropriate)
216+
* Add non-root user, drop caps, read-only fs, non-privileged port
217+
218+
```dockerfile
219+
FROM node:18-alpine
220+
RUN adduser -D app && npm i -g serve
221+
WORKDIR /app
222+
COPY --chown=app:app . .
223+
USER app
224+
EXPOSE 8080
225+
CMD ["serve","-p","8080","-s","build"]
226+
```
227+
228+
13. **AWS IAM least privilege with Conditions**
229+
**Prompt:** Tighten this overly broad policy granting S3 `s3:*` on `*`.
230+
**Good answer:** Resource scoping to specific buckets/prefixes, `aws:PrincipalTag/SourceIp` conditions, require TLS, deny unencrypted puts; example Condition:
231+
232+
```json
233+
"Condition":{"Bool":{"aws:SecureTransport":"true"},"StringEquals":{"s3:x-amz-server-side-encryption":"aws:kms"}}
234+
```
235+
236+
14. **K8s provenance gate in CI**
237+
**Prompt:** Fail pipeline if image lacks valid Cosign signature from your org.
238+
**Expected commands:**
239+
`cosign verify --certificate-identity "https://github.com/yourorg" --certificate-oidc-issuer https://token.actions.githubusercontent.com $IMAGE`
240+
Gate with non-zero exit; or `policy-controller`/admission verify at cluster.
241+
242+
---
243+
244+
## C) Optional Deep-Dive Follow-ups (use as probes)
245+
246+
* “Show the exact `trivy fs` command to scan a monorepo subdir and fail only on HIGH/CRITICAL.”
247+
* “Write a minimal NetworkPolicy to default-deny egress.”
248+
* “Explain how you’d implement SLSA provenance checks in GitHub Actions with `cosign attest`.”
249+
250+
---
251+
252+
## Scoring Guidance (quick rubric)
253+
254+
* **Architecture & strategy (Q1–10):** clarity, trade-offs, and mapping to controls (0–20).
255+
* **Cloud/K8s/App specifics (Q11–16):** depth and correctness (0–20).
256+
* **IR, compliance, metrics (Q17–22):** practicality and measurability (0–15).
257+
* **Hands-on fluency (Practical 1–14):** correct commands/flags/configs, minimal but secure solutions (0–35).
258+
* **Communication:** concise, business-aware reasoning (0–10).
259+
260+
---

0 commit comments

Comments
 (0)