CI/CD Flashcards
(30 cards)
Q: What does CI/CD stand for?
A: Continuous Integration and Continuous Deployment/Delivery.
Q: What is the main goal of Continuous Integration (CI)?
A: To automate the building and testing of code with each commit.
Q: What distinguishes Continuous Deployment from Continuous Delivery?
A: Continuous Deployment automates the full release to production.
Q: Where are GitHub Actions workflow files stored?
A: In the .github/workflows/ directory.
Q: What format are GitHub workflow files written in?
A: YAML.
Q: What are GitHub “jobs” in a workflow?
A: A set of steps that execute on a runner.
Q: What is the function of a GitHub runner?
A: To execute workflow jobs.
Q: What event can trigger a GitHub Action workflow?
A: Events like push, pull_request, schedule, etc.
Q: What file defines GitLab CI/CD pipelines?
A: .gitlab-ci.yml.
Q: What are “stages” in GitLab pipelines?
A: They define the logical flow of a pipeline (e.g., build → test → deploy).
Q: What are “jobs” in GitLab CI/CD?
A: Tasks that run in specific stages of the pipeline.
Q: What is a GitLab runner used for?
A: To execute CI/CD jobs.
Q: What are artifacts in CI/CD pipelines?
A: Files generated during jobs and passed to later stages.
Q: Why should SOC teams monitor GitHub workflow file changes?
A: To detect unauthorized edits or malicious actions.
Q: What can unauthorized third-party actions in workflows indicate?
A: Potential exploitation or abuse of CI/CD pipelines.
Q: Why are secrets management important in pipelines?
A: Secrets can be exposed in logs or abused by attackers.
Q: What should SOC teams monitor about runner environments?
A: Integrity, unauthorized access, and use of unapproved scripts/images.
Q: What is a sign of crypto mining in CI/CD environments?
A: Abnormally long or resource-intensive jobs.
Q: What is one method attackers use to move laterally via CI/CD?
A: Using compromised workflows to access other resources.
Q: How can artifacts be abused by threat actors?
A: For malware delivery or data exfiltration.
Q: What is a mitigation for secrets being exposed in pipeline logs?
A: Redacting logs and scanning for secrets.
Q: What should trigger an alert in CI/CD monitoring?
A: Unauthorized workflow modification or access anomalies.
Q: What tools should be integrated into CI/CD for security?
A: Code scanning, secret detection, and SIEM log integration.
Q: What logs are valuable for SOC monitoring from GitHub?
A: GitHub Audit Logs.
