CompTIA SecurityX Practice Questions: DevSecOps

8 free, exam-style CompTIA SecurityX (CAS-005) practice questions covering DevSecOps, each with the correct answer and an explanation. Start a timed exam below, or scroll on to read through the questions.

🧠

Mini Exam

25 Questions · 50 minutes

Start Quiz 🚀
🏆

Mock SecurityX Exam

85 Questions · 165 minutes

Start Quiz 🚀
📅

Daily Quiz

10 Questions · 20 minutes

Start Quiz 🚀
🎯

Standard Practice

50 Questions · 100 minutes

Start Quiz 🚀

DevSecOps practice questions

Answers and explanations are shown. Take the timed exam above to test yourself first.

Q1. Which of the following is a key security control for Git repositories?

  • A.Storing secrets in code
  • B.Pre-commit hooks and secret scanning✓ Correct
  • C.Disabling branch protection
  • D.No code reviews
Explanation: Pre-commit hooks can prevent secrets from being committed. Learn more.

Q2. What is the PRIMARY security risk of unsecured CI/CD pipelines?

  • A.Slower deployments
  • B.Introduction of malicious code into production✓ Correct
  • C.Improved compliance
  • D.Increased manual testing
Explanation: Compromised pipelines can lead to supply chain attacks. Learn more.

Q3. What is the PRIMARY security consideration for container registries?

  • A.Public access by default
  • B.Image signing and vulnerability scanning✓ Correct
  • C.Disabled authentication
  • D.No version control
Explanation: Container images must be verified and scanned before deployment. Learn more.

Q4. Why sign container images before deployment?

  • A.To verify image integrity and publisher authenticity✓ Correct
  • B.To increase container CPU limits
  • C.To disable vulnerability scanning
  • D.To convert containers into virtual machines
Explanation: Image signing helps deployment systems verify that an image has not been tampered with and came from a trusted publisher. Learn more.

Q5. Which control helps ensure production infrastructure changes are repeatable and reviewed?

  • A.Infrastructure as Code with version control✓ Correct
  • B.Manual console changes without tickets
  • C.Shared spreadsheet passwords
  • D.Unlogged emergency changes
Explanation: Infrastructure as Code stored in version control supports peer review, repeatability, rollback, and auditability. Learn more.

Q6. Which control best protects secrets used by CI/CD pipelines?

  • A.Secrets vault with short-lived credentials✓ Correct
  • B.Plaintext variables in scripts
  • C.Shared wiki page
  • D.Hardcoded tokens in repositories
Explanation: Secrets vaults and short-lived credentials reduce exposure and simplify rotation for build and deployment systems. Learn more.

Q7. Which operational model combines development, security, and operations controls throughout the pipeline?

  • A.DevSecOps✓ Correct
  • B.Waterfall-only security signoff
  • C.Break-fix maintenance
  • D.Untracked scripting
Explanation: DevSecOps integrates security testing and controls into development and operations workflows. Learn more.

Q8. Which control helps verify that production container deployments use only approved images?

  • A.Admission controller policy✓ Correct
  • B.Manual SSH edits
  • C.Public anonymous registry pulls
  • D.Unscanned base images
Explanation: Admission controllers can enforce image signature, source, and policy requirements before workloads run. Learn more.

More CompTIA SecurityX practice topics

Keep studying CompTIA SecurityX

Full CompTIA SecurityX practice exam · CompTIA SecurityX study guide · All CompTIA practice questions

Last updated