Sécurité
DevSecOps quiz
Knowledge checks for the DevSecOps training path, in English: threats, code and dependencies, pipelines, containers, supply chain, secrets and vulnerabilities.
- 1 094 questions in the bank drawn at random at each attempt
- 100 topics to see the result topic by topic
- 100 linked guides to review after a wrong answer
Knowledge checks for the DevSecOps training path, in English: threats, code and dependencies, pipelines, containers, supply chain, secrets and vulnerabilities.
1,094 questions in the bank 100 topics 100 linked guides
How this exam works Questions drawn at random from the whole bank, shuffled answers, no time limit, explanations when graded.
An exam draws from the whole bank (1,094 questions, 100 topics) and gives a result per topic, whereas a lesson quiz only checks that lesson. The level sets the number of questions; the duration shown is an estimate, no timer stops the exam. Every draw is different: retaking the same level does not bring back the same questions.
Random: questions drawn at random
Shuffled: answers reordered
No limit: take your time
Explanations: links to the docs
Choose your level
Questions are drawn at random on every attempt: you can retake the same level without getting the same questions.
Related documentation
Read these pages to go deeper before or after the quiz:
- DevSecOps common thread: notes-api from V0 to V11
- Understanding CVE, CVSS and EPSS to prioritise
- DAST: testing the security of a running application
- Gitleaks: scan your Git repositories for exposed secrets
- SAST: analysing source code to find flaws
See the 95 other pages
- SCA: analysing dependency vulnerabilities
- Secrets in code and Git history
- Securing npm, PyPI and Go dependencies
- Automated security testing: SAST, DAST, SCA, fuzzing
- Semgrep: static code analysis for security
- Checkov: scanning infrastructure as code
- Container registries: understanding image storage and distribution
- Securing Docker in production
- Dockerfile best practices (cache, .dockerignore, multi-stage, non-root)
- Trivy: vulnerability, secret and IaC scanner
- Agile, DevOps and SRE: three complementary approaches
- DevOps anti-patterns: the traps to avoid
- What is DevOps? Origin, definition and ecosystem
- Feedback loops: the engine of continuous improvement
- Where to place DevOps roles in Team Topologies?
- Team Topologies: structuring your DevOps teams
- Three Ways and CALMS: the foundations of DevOps
- Value Stream and Flow: optimising the value stream (DevOps)
- CI, Continuous Delivery, Continuous Deployment: which level to choose?
- CI/CD anti-patterns: recognising and fixing pipeline mistakes
- CI/CD best practices: the invariants of a reliable pipeline
- Deployment strategies: blue-green, canary, rolling
- Feature Flags: decoupling deployment and release
- GitOps: principles, ArgoCD vs Flux and implementation
- Jenkins on Kubernetes: installing with Helm and running a first pipeline
- Modern CI/CD pipeline architectures: branches, repositories, artifacts
- Testing strategies: the safety net of DevOps
- Trunk-Based Development and Git branching models
- What is a CI/CD pipeline? Jobs, runners, cache and artifacts
- Why CI/CD pipelines fail: the organisational causes
- DevSecOps: security built into development
- Security by design vs security after the fact
- Security: a matter of trade-offs
- Shared responsibility: who does what in security
- Shift-left: detecting problems as early as possible
- Why security fails in practice: the real causes
- CINC Auditor: scanning the compliance of your containers
- Assessing your DevSecOps maturity with OWASP DSOMM
- DevSecOps maturity and roadmap: a 5-level model
- Security debt: understanding a cost that piles up
- DevSecOps security KPIs: measuring your security posture
- DevSecOps technology watch: sources, tools and routines
- CVE vulnerability management: from triage to patch
- Hardening the build environment: securing runners and pipelines
- Implicit trust in CI/CD pipelines
- Living Off The Pipeline: when your DevOps tools become weapons
- OWASP Top 10 CI/CD: the 10 security risks of pipelines
- Blocking a pipeline does not improve security: gates and guardrails
- Securing secrets in your CI/CD pipelines
- Secrets scanning: detecting secrets exposed in code
- Secure CI/CD pipeline: gates, secrets, signing
- Securing a CI/CD pipeline: the four control surfaces
- Source code governance: rulesets, tags and CODEOWNERS
- Runbooks and incident response: from diagnosis to action in 5 minutes
- Incidents and postmortems: handling the crisis, learning without blame
- Observability: logs, metrics and traces
- On-call: organising production duty
- SLOs, SLIs and error budgets: measuring and steering reliability
- SRE in practice: reliability at scale
- Introduction to Site Reliability Engineering (SRE)
- Eliminating toil: automating work with no value
- Falco - Runtime threat detection in Kubernetes
- Kubernetes supply chain security: securing the delivery chain
- Kyverno, the Kubernetes policy engine in YAML and CEL
- Kubernetes NetworkPolicies: isolating traffic between Pods
- Pod Security Standards (PSS): securing Kubernetes workloads
- Container security: images, clusters, runtime
- Responding to a compromised secret: revoke, rotate, analyse
- Secret lifecycle: the 8 key stages
- The secret zero problem: who hands out the first secret?
- SOPS: encrypting your secrets in Git
- Why static secrets are a problem
- Machine identity and workload identity
- DevSecOps best practices: the 4 pillars to master
- Dev-Sec collaboration and feedback loops
- Implementing DORA metrics: a practical guide for 2026
- DORA metrics: measuring DevOps performance
- Platform Engineering
- Security Champions: build and run a programme
- Training teams in security: a complete programme
- Varnish Artifact Firewall: controlling dependency intake
- Cosign: signing and verifying your container images
- SBOM: the inventory of what you ship, measured with Syft
- From SLSA provenance to decision: blocking non-compliant artifacts
- Responding to a supply chain incident: scope, containment, notification
- Software supply chain security: SBOM, SLSA, Sigstore
- Transitive trust: inheriting the risk of your chain
- VEX: saying what is really exploitable, measured with Grype
- Attack surface: what your system exposes
- Defence in depth: securing in layers
- Least privilege: grant just what is needed
- OWASP Top 10 2025 applied to DevSecOps
- Threat modeling with STRIDE: a practical DevSecOps guide
- Threat, risk, vulnerability, attack: understanding the differences
- OpenSSF Scorecard
Topics covered
pod security admission 25
docker securite 19
shift left 19
devsecops 17
falco 16
dockerfile bonnes pratiques 15
kyverno 15
threat modeling stride 15
See the 92 other topics
gitleaks 14
menaces risques 14
pourquoi securite echoue 14
responsabilites partagees 14
secrets code git 14
securite by design 14
owasp top 10 cicd 13
owasp top 10 devsecops 13
surface attaques 13
tests securite 13
artifact firewall 12
audit maturite 12
checkov 12
cinc auditor 12
confiance implicite 12
cosign 12
cycle vie secret 12
dast 12
dora implementation 12
gestion vulnerabilites cve 12
identite machine workload identity 12
incident supply chain 12
k8s supply chain 12
maturite roadmap 12
moindre privilege 12
pipeline securise 12
sast 12
sbom 12
scorecard 12
secret compromis 12
secret zero 12
secrets ci cd 12
secrets statiques probleme 12
securite conteneurs 12
security kpis 12
slsa provenance decision 12
sops 12
supply chain security 12
trivy 12
vex 12
ci vs cd 11
cve 11
gouvernance code source 11
hardening build 11
lotp 11
network policies 11
platform engineering 11
sca 11
securiser dependances 11
securiser pipeline 11
semgrep 11
projets fil rouge devsecops 10
strategies deploiement 10
toil automatisation 10
bonnes pratiques cicd 9
gitops 9
anti patterns cicd 8
anti patterns devops 8
bonnes pratiques 8
boucle retroaction 8
collaboration feedback 8
compromis securite 8
confiance transitive 8
culture devops 8
defense profondeur 8
definition pipeline 8
dette securite 8
devops agile sre 8
dora 8
feature flags 8
formation equipes 8
formes pipelines 8
incidents postmortems 8
jenkins 8
observabilite 8
on call astreintes 8
pourquoi echouent pipelines 8
registres 8
roles team topologies 8
runbooks incident 8
secrets scanning 8
securite punitive 8
security champions 8
slo sli error budget 8
sre 8
sre pratique 8
team toplogies devops 8
testing 8
three ways calms 8
trunk based development 8
value stream flow 8
veille 8