DevSecOps Pipeline – Operate and Monitor Stage
The final domain covers runtime detection, incident response and the feedback loop that returns production evidence into planning. Exam items test observability, runtime security tooling, IR phases and vulnerability SLAs.
Core rules
- Observability rests on three pillars: metrics, structured logs and distributed traces. Monitoring tells you a known thing is broken; observability lets you ask new questions about unknown failure modes.
- Runtime security instruments workloads for behaviour that static checks cannot see - unexpected shell spawns in a container, privilege escalation, outbound connections to unknown hosts, file writes to sensitive paths. Tools such as Falco or eBPF-based sensors generate these alerts.
- SIEM and correlation: centralise authentication, audit, network and application logs; detect patterns across sources; forward cloud audit logs to immutable storage.
- Incident response follows NIST SP 800-61 phases: preparation, detection and analysis, containment/eradication/recovery, post-incident activity. Containment before root-cause analysis prevents spread.
- Vulnerability management SLAs are tiered by severity and exploitability, and include runtime image re-scanning so new CVEs in old images are caught.
- Drift detection and chaos engineering verify that what runs matches what was declared and that failure modes are understood.
Worked example
Falco fires: shell spawned inside container on a pod that should only run a Node.js server. Reasoning path: verify the alert is real (not a debug sidecar), isolate the pod from the network without destroying evidence, capture the process tree, image digest and recent logs, then check whether the image ran as non-root and whether the container had a read-only filesystem. If the shell came from an exploited dependency, the fix returns to the Build stage - patch the library, add a reachability-aware test, and tighten the admission policy to block root containers. Containment first, root cause second, pipeline change third: that ordering is what the exam rewards.
Traps that cost marks
- Equating 'we have dashboards' with observability; missing traces and structured context break investigation.
- Logging secrets, tokens or full PII into centralised logging, creating a second breach surface.
- Alerting on everything until the on-call engineer mutes the channel - tune for actionability.
- Treating incident response as an ops-only activity; the post-incident actions belong in the dev backlog.
- Destroying the container or node before capturing forensic evidence.
- Closing a vulnerability ticket because the old image was patched, without re-scanning images already running.