DevSecOps Foundation study guide
DevSecOps Foundation · Work through your exam, one topic at a time.
The DevSecOps Foundation℠ certification, offered by DevOps Institute, is a credential for professionals who want to embed security into DevOps workflows. It targets a broad audience: compliance team and delivery staff, project and product managers, IT managers, IT security professionals, practitioners and managers, site reliability engineers, DevOps engineers, software engineers, maintenance and support staff, managed service providers, quality assurance teams, release managers, Scrum Masters, and testers. The DevSecOps Foundation study guide has 9 sections and about 4,260 words.
01Why DevSecOps? - Drivers, Failure Modes, and the Models the Exam Tests
domain tests whether you can justify the change, not just describe it. Questions probe the failure modes of traditional security, the business and technical drivers behind DevSecOps, and the models the exam uses to describe flow, feedback and learning.
487 words, about 2 min02Culture and Management - Safety, Champions, and Metrics That Do Not Backfire
This domain tests the human system that makes DevSecOps stick: psychological safety, blameless handling of failure, leadership sponsorship, team structures that scale scarce security expertise, and measurement that encourages disclosure instead of concealment. Scenario questions usually show a team hiding risk or a security team bottlenecked on reviews, and ask for the organizational fix.
463 words, about 2 min03Strategic Considerations - Value Stream, Maturity, Metrics, and Supply Chain
The strategic domain tests planning rather than doing: how to sequence adoption, where security work actually waits, how to measure progress honestly, how to choose and integrate tooling, and how to manage supply chain and cloud risk at program level. Questions often present an organization with many applications and few security engineers.
471 words, about 2 min04General Security Considerations - Fundamentals, Risk, and Prioritization
This domain checks the security literacy assumed by every other domain: the CIA triad, defense in depth, risk treatment, threat modeling, vulnerability prioritization, cryptography in practice, and supply chain exposure. Questions are usually short scenarios asking which concept applies or which finding to fix first.
452 words, about 2 min05IAM - Authentication, Federation, Least Privilege, and Workload Identity
Identity and Access Management is the control plane of modern environments and a frequent source of real breaches. The exam tests authentication versus authorization, federation protocols, access models, privileged access, secrets handling, non-human identities in pipelines, and zero trust as an architectural stance.
467 words, about 2 min06Application Security - SSDLC, Testing Types, and Guardrails in the Pipeline
Application security questions test how controls are placed across the software development lifecycle, which testing technique answers which question, and how to enforce standards without stopping delivery. Expect questions on threat modeling, secure coding standards, SAST versus DAST versus SCA, dependency and supply chain controls, and build-breaking policy.
470 words, about 2 min07Operational Security - Hardening, Infrastructure, Runtime, and Resilience
Operational security covers running systems safely after deployment: hardening, patch and image management, infrastructure as code, cloud and Kubernetes configuration, production access, network controls and resilience. Questions often describe a runtime weakness that build-time controls could not prevent.
478 words, about 2 min08GRC and Audit - Continuous Compliance, Control Mapping, and Evidence
Governance, risk, compliance and audit questions test whether you can make compliance a by-product of engineering rather than a seasonal scramble. Expect questions on risk treatment, framework scope, control mapping across standards, separation of duties in pipelines, exception handling and automated evidence.
505 words, about 3 min09Logging, Monitoring, and Response - Telemetry, Detection, and the Feedback Loop
This domain tests detection and response as an engineering discipline: what telemetry to collect, how to keep logs trustworthy, how to detect and prioritize events, how the incident response lifecycle runs, and how findings feed back into prevention. Scenario questions often describe an attack in progress and ask for the correct phase or the least disruptive containment.
467 words, about 2 min