SKILL BENCHMARK
DevSecOps Competency (Intermediate Level)
- 27m
- 27 questions
The DevSecOps Competency (Intermediate Level) benchmark assesses your understanding of security concepts in the DevOps process. You will be evaluated on your knowledge of how DevSecOps teams should respond to incidents and increase security posture, utilizing DevSecOps in AWS and Azure, DevSecOps benefits for delivery and security, and important DevSecOps tools. A learner who scores high on this benchmark demonstrates that they have the skills necessary to apply concepts related to on-premises and cloud DevSecOps, the fundamentals of DevSecOps, DevSecOps and containers, and important DevSecOps tools.
Topics covered
- define dependency analysis and describe how it is used to analyze dependencies between activities
- describe common challenges of implementing DevSecOps in Azure
- describe DAST, or dynamic analysis
- describe how API microgateways can complement programming language frameworks to help secure development practices
- describe how assessing risks and maturing security are pillars of the DevSecOps model
- describe how DevSecOps teams can effectively monitor and respond to security incidents
- describe how the Google Cloud Logging service can be used to review data for the DevSecOps pipeline
- describe some platform-specific tools used to help implement DevSecOps in Azure
- describe the capabilities enabled by Azure that can help ease into a DevSecOps workflow
- describe ways in which DevSecOps teams should respond to incidents and how they can increase their security posture
- differentiate between Kubernetes and Docker container orchestration systems
- differentiate between virtualization and containerization and outline key benefits provided by both
- identify common benefits of DevSecOps including delivery and security
- list common challenges of the adoption of DevOps and DevSecOps
- list common IaC security tools, including Anchore, Clair, Dagda, OpenSCAP, dockscan, and Chef InSpec
- list common SAST and DAST DevSecOps tools, including Bandit, Clean Code, looks good to me (LGTM), OWASP Zed Attack Proxy (ZAP), and Nikto
- list fundamental DevSecOps requirements, including automation, collaboration, visibility, and policy
- list key elements of DevSecOps, such as vulnerability scanning and runtime protection
- outline best practices for moving towards a DevSecOps process, including continuous learning, Defense in Depth, and average detection and recovery times
- outline common benefits of practicing DevSecOps in AWS
- outline platform-specific security best practices and recommendations for AWS
- outline platform-specific security best practices and recommendations for Azure
- provide an overview of AWS services and features, including identity and access management, detection, infrastructure protection, data protection, incident response, and compliance
- provide an overview of IaC security
- provide an overview of SAST, or static analysis
- provide an overview of the DevOps life cycle
- provide an overview of vulnerability management tools, including Jackhammer, DefectDojo, and ArcherySec
RECENTLY ADDED COURSES
Course