Application Security and Secure DevOps in the Cloud
What this domain tests
Application Security and Secure DevOps in the Cloud tests how security is built into the software lifecycle and CI/CD pipeline. Expect questions on IaC scanning, SAST/DAST/SCA, container security, supply-chain integrity, secrets handling, and least-privilege deployment identities.
Core rules and concepts
- Shift controls left, but keep runtime controls: threat modeling and secure design, code review, SAST, dependency scanning, IaC policy checks, image scanning, DAST, and production monitoring.
- Infrastructure as code must be reviewed and scanned before apply. Policy-as-code can block public storage, open security groups, unencrypted volumes, and missing logging.
- Pipelines are privileged systems. Use short-lived OIDC federation to cloud roles, not long-lived keys; restrict who can change pipeline definitions and protect branches.
- Build immutable artifacts, sign them, and deploy by digest rather than mutable tags. Verify provenance and scan base images; rebuild rather than patch running containers in place.
- Separate duties: developers should not approve their own production changes; break-glass access must be audited.
Worked example
A pull request adds a Terraform bucket with a public ACL. The pipeline runs an IaC policy check that fails the build, and branch protection prevents merge without review. The deployment job assumes a cloud role through OIDC with permissions only to create approved resource types in the target account. At runtime, CSPM detects drift and alerts. The reasoning is layered: prevention at PR, constrained deployment identity, and detection after deployment. A comment in code review alone is not a control.
Traps that cost marks
- Treating SAST as a substitute for DAST or runtime protection.
- Storing secrets in repository variables, image layers, or build logs.
- Using mutable latest tags and unsigned images in production.
- Giving CI/CD administrator permissions for convenience.
- Scanning only after deployment, when the artifact is already live.