DevSecOps Foundation exam-day guide
DevSecOps Foundation · Prepare for the day ahead.
Your checklist
Government-issued photo ID
Bring the exact ID name and format your registration uses; if your registration name differs from your ID, confirm with the provider how to reconcile it before test day.
Exam appointment confirmation and login details
Save the confirmation email and any candidate ID or launch link offline (screenshot or PDF) so a portal outage does not block you. Confirm with the provider whether you launch from an email link or a candidate dashboard.
Quiet, private room with a stable connection
For remote proctoring, use a room with a door you can close, no other people, and a wired or strong Wi-Fi connection. Clear the desk of papers, phones, and second screens unless the provider explicitly allows them.
Working webcam, microphone, and speakers
Test them the day before. Many remote-proctored exams require a 360-degree room scan and a live photo, so a broken camera can end the session before it starts.
System and browser check
Run the provider's system test on the same machine and browser you will use. Close VPNs, virtual machines, and remote-desktop tools unless the provider says otherwise.
Confirm exam logistics with the provider
Verify exam duration, number of questions, passing score, whether breaks are allowed, and whether any notes or reference material are permitted. Do not assume these; confirm with the provider.
Confirm reschedule and cancellation terms
Know the deadline and fee for moving your appointment in case of illness or technical failure. Confirm with the provider; policies vary.
Scratch paper and pen only if permitted
Many proctored exams ban all writing materials or require an on-screen whiteboard. Confirm with the provider before bringing anything to write on.
Water and a light snack for before the session
Consume them before you start; eating and drinking during a proctored exam is often restricted. Confirm with the provider whether water is allowed at the desk.
Plan for a technical failure
Know the provider's support phone number or chat and keep it reachable. If the session drops, do not restart on your own; contact support and follow their instructions.
Rest and a realistic schedule
Book the slot at a time you are normally alert, and protect the hour before it from meetings or travel.
Domain-focused final review sheet
One page of your own notes on weak areas: CI/CD pipeline security, infrastructure as code scanning, secrets management, threat modeling, supply chain and SBOM, and DevSecOps metrics. Review it, then put it away before the exam starts.
Plan the day
Take one full-length timed practice set under exam conditions to calibrate pacing. Review every wrong answer by category, not by question, and list the three domains where you lose the most points. Spend the remaining study time on those three only. Stop learning new tools or frameworks now; consolidate what you know.
Build your one-page review sheet from memory, then check it against your notes. Focus on the concepts that recur across DevSecOps work: shifting security left into design and code, security as code and policy as code, automated gates in CI/CD, dependency and container scanning, secrets handling, least privilege, and how to measure a program with lead time, change failure rate, and mean time to remediate. Confirm exam logistics with the provider if anything is still unclear.
Run the system test and camera/microphone check on your exam machine. Clear the desk and the room. Confirm your ID, appointment time, time zone, and launch instructions. Charge devices and locate chargers. Do a light review of your one-page sheet only, then stop. Sleep at your normal time; cramming the night before costs more in focus than it gains in recall.
Eat a normal meal and hydrate before the session. Recheck the connection, camera, and microphone. Close all other applications, tabs, and notifications. Have your ID and support contact within reach. Log in early, as check-in and identity verification can take time, but do not open the exam until instructed.
Read each question fully and watch for qualifiers such as first, best, most, and least. Answer what the question asks, not what your current employer does. On scenario questions, eliminate options that add manual approval where automation belongs, that treat security as a final gate after deployment, or that remove developer ownership. Flag and skip long questions, then return. If a question is unanswerable, choose the best remaining option; there is usually no penalty for guessing, but confirm with the provider. If the session fails, stop and contact support rather than improvising.
Note which topics felt weak while it is fresh, in case you need a retake, and confirm with the provider how and when results are delivered.
Rules to check
Present the ID that matches your registration exactly. If names differ, resolve it with the provider before the appointment; do not expect a proctor to waive it.
Follow the proctor's instructions on room scans, desk clearance, and what may remain on screen. When in doubt, remove the item and ask.
Do not use unauthorized notes, second devices, messaging apps, or another person's help. Remote-proctored sessions are monitored, and violations can void your result.
Breaks are provider-specific. Confirm in advance whether scheduled or unscheduled breaks are allowed and whether the clock stops; do not leave the camera view without permission.
Scoring and passing standards are set by the provider. Confirm the passing score, question count, and whether wrong answers are penalized before you sit the exam.
If a technical problem occurs, stay calm, note the time, and contact provider support. Do not start a second session or switch machines without guidance.
Arrive or log in early. Late entry may be refused or shorten your time, and reschedule terms are provider-specific, so confirm them beforehand.
Keep the content of the exam confidential. Do not reproduce, share, or discuss specific questions afterward.