Implementation and Operations
What this domain tests
Implementation and Operations tests secure delivery and runtime hygiene: secure SDLC, CI/CD controls, infrastructure as code, secrets management, hardening, patching, and change management. The focus is on preventing drift and proving that controls operate in production.
Core rules and concepts
- Shift left, but verify right: SAST, dependency scanning, and secret scanning belong in pull requests; runtime admission control and drift detection belong in production.
- Build provenance: sign artifacts and images, pin dependencies by digest, and use immutable tags rather than mutable
latest. - Secrets management: store secrets in a vault or managed secret store, inject at runtime, rotate them, and never commit them to source or bake them into images.
- Hardening: apply CIS benchmarks or vendor baselines, remove unused services, restrict administrative ports, and enforce configuration as code.
- Patch management: inventory versions, prioritize by exposure and exploitation, test, deploy, and verify. Emergency patching needs an auditable path.
- Environment separation: development, test, and production need distinct credentials, data, and network policy.
- Change control: every production change should be reviewed, approved, traceable, and reversible.
Worked example
A container pipeline builds an image, scans it, signs it, and deploys only if the signature and policy pass. The admission controller rejects unsigned images and images with critical exploitable vulnerabilities. Secrets are mounted from a vault at runtime, not set as environment variables. A nightly drift check compares running configuration to the approved baseline. If an emergency patch is required, the same signing and audit steps apply through an expedited approval path.
Traps that cost marks
Secrets in environment variables or Git history; mutable image tags; scanning only production; ignoring configuration drift; and treating a successful build as proof of secure runtime state.
Exam-ready summary
Secure the pipeline, the artifact, the runtime, and the change record.