Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

SANS > DevOps 540 > Flashcards

DevOps 540 Flashcards

1
Q

CALMS

A

Culture, automation, lean, measurement, Sharing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

CI/CD Change frequency

A

How often are changed deployed to production. Measure the efficiency and the capability of the organisation to make changes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Change Failure Ratio

A

How often do changes introduce a failure. Opposite to Change Success Rate.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Change Success Ratio

A

How often a changes does NOT introduce a failure. Opposite to Change Failure Ratio

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

MTTR

A

Mean Time to Recovery or Repair from a failure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

MTTD

A

Mean Time to Detect a failure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

MTTF

A

Mean Time to Failure. Not used in DevOps a lot as expected to have a failure. MTTR/MTTD are the key ones.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Change Lead Time

A

The average time it takes to get a change or fix into production. Also known as Cycle Time.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Change Cycle Time

A

from a change is requested by business until when it is deployed. X = Change request + start dev + end dev + deployment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Development change lead time

A

From where the project starts until is fully deployed. X = start dev + end dev + deployment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Deployment Lead time

A

Development is finished until it is deployed == deployment time. X = end dev + deployment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

IAST

A

Interactive Application Security Testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

DAST

A

Dynamic Analysis Security Testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

SAST

A

Static Analysis Security Testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

RASP

A

Runtime Application Security /Safe Protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

SDLC

A

Secure Deployment Life Cycle

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

CSPM

A

Cloud Security Posture Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

CWPP

A

Cloud Workload Protection Platform

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

CASB

A

Cloud Access Security Broker

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

CNAPP

A

Cloud Native Application Protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

IDOR

A

Insecure Direct Object Reference

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

CDN

A

Content Delivery Network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

OAI

A

Origin Access Identity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

SOP

A

Same Origin Policy: protocol, port, domain

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
CORS
Cross-Origin Resource Sharing
26
ZTA
Zero Trust Architecture
27
ZTMM
Zero Trust Maturity Model
28
OPA
Open Policy Agent. Language used to apply limitations in containers deployments.
29
OIDC
Open ID Connect
30
JWT
JSON Web Tokens
31
ADFS
Active Directory Federate Services
32
CNCF
Cloud Native Computing Foundation
33
SPIFFE
Secure Production Identify Framework For Everyone
34
CNI
Container Network Interface
35
RBAC
Role Base Access Control
36
CEL
Common Expression Language
37
SCA
Software component analysis. To identify code with known vulnerabilities.
38
Continuous Delivery
Code -> Unit Test -> Integrate -> Acceptance Test -(manual)-> Deploy. If auto it will be continuous deployment
39
Continuous Deployment
Code -> Unit Test -> Integrate -> Acceptance Test -(auto)-> Deploy. If manual will be continuous delivery
40
Acceptance tests
Ensure code can be joined with production. Achieved via stand-up test environments via Puppet/Chef/TF/Docker/etc and run post-deployment asserts/smoke tests
41
IdP
Identity Provider for Oauth/OIDC (against what we authenticate)
42
Service provider in OIDC
Service we try to access to.
43
RRA
Rapid Risk Assessment. 30 min review to understand if the new code will have issues or what level of review will require. Introduced by Firefox.
44
A/B testing
Experiments of a code for a subset of the population
45
SBOM
Software Bill of materials. This is needed to understand the dependencies of an application and hence their vulnerabilities.
46
OWASP: PPE
Poisoned pipeline Execution: manipulating the build process by injecting malicious code or commands into the build pipeline configuration
47
OWASP: PBAC
Pipeline based access control. An attacker could abuse insufficient PBAC to abuse the permissions granted to the pipeline and move laterally to systems services outside the CI/CD
48
SARIF
Static Analysis Results Integration Format. Created by MS, a JSON language of creating one universal format for static analysis tool.
49
SPDX
Software Package Data Exchanges: open source output language for software bills (SBOMs)
50
HCL
Hashicorp Configuration Language
51
Azure NSG
Azure Network Security Group
52
TDD
Test-Driven Development. Automated tests written before the code is changed to prove that changes are implemented correctly
53
DSL
Domain Specific Language. Used in configuration management tools like chef, puppet, ansible, etc
54
OPA
55
Software Provenance
An attestation (metadata) describing how the outputs were produced, including identification of the platform and external parameters
56
Software Attestation
An authenticate statement (metadata) about a software artifact or collection of software artifacts
57
DSSE
Dead Simple Signing Envelope. Store the envelope = statement and signature for the provenance statement to prevent supply chain attacks.
58
OCI
Open Container Initiative
59
SLSA
Supply-chain levels of Software artifacts. Level0 to Level 3: none, provenance showing how the packages were built, signed provenance and generated by a hosted build platform, hardened build platform
60
VEX
Vulnerability Exploitability Exchanged. machine readable attestations format for sharing vulnerability status information.
61
GUAC
Graph for Understanding Artifact Composition. Graph base system that organizes software supply chain security artifacts.
62
CRI
Container Runtime Interface
63
AWS ECR
Elastic Container Registry for container images
64
Google Cloud GCR
Google Container Registry for container images
65
Azure ACR
Azure Container Registry for container images
66
Image Poison Attack in containers
A certified image tag is overwritten with a malicious image using the same tag. This is prevented via Immutable tagging in Cloud container registry
67
Azure CMK
Customer Managed keys used for Azure storage encryption (EKS in Azure)
68
IRSA
AWS IAM Roles for Service Accounts
69
IMDS
AWS Instance Metadata Service
70
K8s CEL
Common Expression Language used for K8s policies
71
Azure OMS
Operational Management Suit. Azure log agent for Linux or EKS
72
Azure MMA
Microsoft Monitoring Agent. Azure log agent for Windows systems

SANS (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions