Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

SANS > DevOps 540 > Flashcards

DevOps 540 Flashcards

1
Q

CALMS

A

Culture, automation, lean, measurement, Sharing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

CI/CD Change frequency

A

How often are changed deployed to production. Measure the efficiency and the capability of the organisation to make changes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Change Failure Ratio

A

How often do changes introduce a failure. Opposite to Change Success Rate.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Change Success Ratio

A

How often a changes does NOT introduce a failure. Opposite to Change Failure Ratio

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

MTTR

A

Mean Time to Recovery or Repair from a failure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

MTTD

A

Mean Time to Detect a failure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

MTTF

A

Mean Time to Failure. Not used in DevOps a lot as expected to have a failure. MTTR/MTTD are the key ones.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Change Lead Time

A

The average time it takes to get a change or fix into production. Also known as Cycle Time.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Change Cycle Time

A

from a change is requested by business until when it is deployed. X = Change request + start dev + end dev + deployment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Development change lead time

A

From where the project starts until is fully deployed. X = start dev + end dev + deployment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Deployment Lead time

A

Development is finished until it is deployed == deployment time. X = end dev + deployment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

IAST

A

Interactive Application Security Testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

DAST

A

Dynamic Analysis Security Testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

SAST

A

Static Analysis Security Testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

RASP

A

Runtime Application Security /Safe Protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

SDLC

A

Secure Deployment Life Cycle

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

CSPM

A

Cloud Security Posture Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

CWPP

A

Cloud Workload Protection Platform

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

CASB

A

Cloud Access Security Broker

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

CNAPP

A

Cloud Native Application Protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

IDOR

A

Insecure Direct Object Reference

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

CDN

A

Content Delivery Network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

OAI

A

Origin Access Identity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

SOP

A

Same Origin Policy: protocol, port, domain

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

CORS

A

Cross-Origin Resource Sharing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

ZTA

A

Zero Trust Architecture

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

ZTMM

A

Zero Trust Maturity Model

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

OPA

A

Open Policy Agent. Language used to apply limitations in containers deployments.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

OIDC

A

Open ID Connect

30
Q

JWT

A

JSON Web Tokens

31
Q

ADFS

A

Active Directory Federate Services

32
Q

CNCF

A

Cloud Native Computing Foundation

33
Q

SPIFFE

A

Secure Production Identify Framework For Everyone

34
Q

CNI

A

Container Network Interface

35
Q

RBAC

A

Role Base Access Control

36
Q

CEL

A

Common Expression Language

37
Q

SCA

A

Software component analysis. To identify code with known vulnerabilities.

38
Q

Continuous Delivery

A

Code -> Unit Test -> Integrate -> Acceptance Test -(manual)-> Deploy. If auto it will be continuous deployment

39
Q

Continuous Deployment

A

Code -> Unit Test -> Integrate -> Acceptance Test -(auto)-> Deploy. If manual will be continuous delivery

40
Q

Acceptance tests

A

Ensure code can be joined with production. Achieved via stand-up test environments via Puppet/Chef/TF/Docker/etc and run post-deployment asserts/smoke tests

41
Q

IdP

A

Identity Provider for Oauth/OIDC (against what we authenticate)

42
Q

Service provider in OIDC

A

Service we try to access to.

43
Q

RRA

A

Rapid Risk Assessment. 30 min review to understand if the new code will have issues or what level of review will require. Introduced by Firefox.

44
Q

A/B testing

A

Experiments of a code for a subset of the population

45
Q

SBOM

A

Software Bill of materials. This is needed to understand the dependencies of an application and hence their vulnerabilities.

46
Q

OWASP: PPE

A

Poisoned pipeline Execution: manipulating the build process by injecting malicious code or commands into the build pipeline configuration

47
Q

OWASP: PBAC

A

Pipeline based access control. An attacker could abuse insufficient PBAC to abuse the permissions granted to the pipeline and move laterally to systems services outside the CI/CD

48
Q

SARIF

A

Static Analysis Results Integration Format. Created by MS, a JSON language of creating one universal format for static analysis tool.

49
Q

SPDX

A

Software Package Data Exchanges: open source output language for software bills (SBOMs)

50
Q

HCL

A

Hashicorp Configuration Language

51
Q

Azure NSG

A

Azure Network Security Group

52
Q

TDD

A

Test-Driven Development. Automated tests written before the code is changed to prove that changes are implemented correctly

53
Q

DSL

A

Domain Specific Language. Used in configuration management tools like chef, puppet, ansible, etc

54
Q

OPA

A
55
Q

Software Provenance

A

An attestation (metadata) describing how the outputs were produced, including identification of the platform and external parameters

56
Q

Software Attestation

A

An authenticate statement (metadata) about a software artifact or collection of software artifacts

57
Q

DSSE

A

Dead Simple Signing Envelope. Store the envelope = statement and signature for the provenance statement to prevent supply chain attacks.

58
Q

OCI

A

Open Container Initiative

59
Q

SLSA

A

Supply-chain levels of Software artifacts. Level0 to Level 3: none, provenance showing how the packages were built, signed provenance and generated by a hosted build platform, hardened build platform

60
Q

VEX

A

Vulnerability Exploitability Exchanged. machine readable attestations format for sharing vulnerability status information.

61
Q

GUAC

A

Graph for Understanding Artifact Composition. Graph base system that organizes software supply chain security artifacts.

62
Q

CRI

A

Container Runtime Interface

63
Q

AWS ECR

A

Elastic Container Registry for container images

64
Q

Google Cloud GCR

A

Google Container Registry for container images

65
Q

Azure ACR

A

Azure Container Registry for container images

66
Q

Image Poison Attack in containers

A

A certified image tag is overwritten with a malicious image using the same tag. This is prevented via Immutable tagging in Cloud container registry

67
Q

Azure CMK

A

Customer Managed keys used for Azure storage encryption (EKS in Azure)

68
Q

IRSA

A

AWS IAM Roles for Service Accounts

69
Q

IMDS

A

AWS Instance Metadata Service

70
Q

K8s CEL

A

Common Expression Language used for K8s policies

71
Q

Azure OMS

A

Operational Management Suit. Azure log agent for Linux or EKS

72
Q

Azure MMA

A

Microsoft Monitoring Agent. Azure log agent for Windows systems

SANS (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions