Secure Software Development Lifecycle and DevSecOps in the Cloud
This domain tests how security activities attach to each delivery phase and how the pipeline itself becomes an attack surface. Items typically ask you to place a control in the right phase or to decide whether a gate should block a build.
Core rules
- Map activities to phases: design (threat model, security requirements, abuse cases), build (secure coding standards, peer review, pre-commit secret scanning), test (SAST, SCA, DAST, IaC scanning, container scanning), release (artifact signing, SBOM, provenance), deploy (least-privilege pipeline identity, admission policy), operate (runtime detection feeding back into design).
- Produce an SBOM per build in SPDX or CycloneDX, and attach provenance and signatures (SLSA, Sigstore/cosign) so the deploy stage can verify what was built and by whom.
- Harden pipeline identity: use OIDC federation from the CI platform to cloud roles rather than stored keys, scope tokens to repository and branch, and keep deploy credentials out of build logs.
- Make gates risk-based. Block on critical findings in reachable production components and high-confidence IaC misconfigurations; route the rest to a backlog with SLAs. A gate that everyone bypasses is worse than none.
- Invest in enablement: secure defaults, service templates, IDE plugins, and security champions produce more durable improvement than policing.
Worked example
A nightly build fails because SCA reports a critical CVE in a test-only transitive dependency. Reasoning: the score is critical but the component is never shipped and not reachable at run time. Blocking on it erodes trust in the gate and encourages bypass. Correct action: upgrade if a fixed version exists; otherwise record a scoped exception with non-reachability evidence and an expiry date, and keep the gate active for production scope. If the same build also flags a high finding in a runtime dependency reachable from user input, that must block.
Traps
Equating shift-left with buying scanners; deleting a leaked secret without rotating it (git history keeps it alive); overlooking IaC misconfiguration and CI tokens as supply chain risk; and treating the SBOM as a compliance artifact rather than an operational input for incident response.