CompTIA SecurityX Practice Questions: DevSecOps

8 free, exam-style CompTIA SecurityX (CAS-005) practice questions covering DevSecOps. Each question shows the correct answer and a clear explanation. Ready for the real thing? Take the full timed quiz below.

🚀 Take the full CompTIA SecurityX quiz 📘 CompTIA SecurityX study guide

Q1. Which of the following is a key security control for Git repositories?

Explanation: Pre-commit hooks can prevent secrets from being committed. Learn more.

Q2. What is the PRIMARY security risk of unsecured CI/CD pipelines?

Explanation: Compromised pipelines can lead to supply chain attacks. Learn more.

Q3. What is the PRIMARY security consideration for container registries?

Explanation: Container images must be verified and scanned before deployment. Learn more.

Q4. Why sign container images before deployment?

Explanation: Image signing helps deployment systems verify that an image has not been tampered with and came from a trusted publisher. Learn more.

Q5. Which control helps ensure production infrastructure changes are repeatable and reviewed?

Explanation: Infrastructure as Code stored in version control supports peer review, repeatability, rollback, and auditability. Learn more.

Q6. Which control best protects secrets used by CI/CD pipelines?

Explanation: Secrets vaults and short-lived credentials reduce exposure and simplify rotation for build and deployment systems. Learn more.

Q7. Which operational model combines development, security, and operations controls throughout the pipeline?

Explanation: DevSecOps integrates security testing and controls into development and operations workflows. Learn more.

Q8. Which control helps verify that production container deployments use only approved images?

Explanation: Admission controllers can enforce image signature, source, and policy requirements before workloads run. Learn more.

More CompTIA SecurityX practice topics