[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"me":3,"catalog:en:security\u002Fds-pipeline-security-gates":4,"config":233},null,{"field_key":5,"field_name":6,"seniority":7,"topic_key":8,"topic_name":9,"spec_key":7,"spec_name":7,"locale":10,"cell_total":11,"field_total":12,"seniorities":13,"topics":17,"specs":130,"samples":147},"security","Security","","ds-pipeline-security-gates","Ds Pipeline Security Gates","en",75,2850,[14,15,16],"junior","mid","senior",[18,21,24,27,30,33,36,39,42,45,48,51,54,57,60,63,66,69,72,75,76,79,82,85,88,91,94,97,100,103,106,109,112,115,118,121,124,127],{"key":19,"name":20,"count":11},"as-access-control-idor","As Access Control Idor",{"key":22,"name":23,"count":11},"as-api-security","As Api Security",{"key":25,"name":26,"count":11},"as-authentication-session","As Authentication Session",{"key":28,"name":29,"count":11},"as-crypto-implementation-pitfalls","As Crypto Implementation Pitfalls",{"key":31,"name":32,"count":11},"as-injection-input-validation","As Injection Input Validation",{"key":34,"name":35,"count":11},"as-secure-sdlc-sast-dast","As Secure Sdlc Sast Dast",{"key":37,"name":38,"count":11},"bt-crisis-communication-management","Bt Crisis Communication Management",{"key":40,"name":41,"count":11},"bt-detection-engineering-tuning","Bt Detection Engineering Tuning",{"key":43,"name":44,"count":11},"bt-digital-forensics-fundamentals","Bt Digital Forensics Fundamentals",{"key":46,"name":47,"count":11},"bt-incident-triage-classification","Bt Incident Triage Classification",{"key":49,"name":50,"count":11},"bt-ir-playbook-execution","Bt Ir Playbook Execution",{"key":52,"name":53,"count":11},"bt-threat-intelligence-application","Bt Threat Intelligence Application",{"key":55,"name":56,"count":11},"cse-container-workload-security","Cse Container Workload Security",{"key":58,"name":59,"count":11},"cse-cspm-misconfiguration","Cse Cspm Misconfiguration",{"key":61,"name":62,"count":11},"cse-data-protection-governance","Cse Data Protection Governance",{"key":64,"name":65,"count":11},"cse-detection-incident-response","Cse Detection Incident Response",{"key":67,"name":68,"count":11},"cse-iam-privilege-escalation","Cse Iam Privilege Escalation",{"key":70,"name":71,"count":11},"cse-network-perimeter-zero-trust","Cse Network Perimeter Zero Trust",{"key":73,"name":74,"count":11},"ds-iac-policy-as-code","Ds Iac Policy As Code",{"key":8,"name":9,"count":11},{"key":77,"name":78,"count":11},"ds-secrets-pipeline-management","Ds Secrets Pipeline Management",{"key":80,"name":81,"count":11},"ds-security-metrics-blameless-culture","Ds Security Metrics Blameless Culture",{"key":83,"name":84,"count":11},"ds-shift-left-security-culture","Ds Shift Left Security Culture",{"key":86,"name":87,"count":11},"ds-software-supply-chain-pipeline","Ds Software Supply Chain Pipeline",{"key":89,"name":90,"count":11},"pt-legal-ethical-boundaries","Pt Legal Ethical Boundaries",{"key":92,"name":93,"count":11},"pt-methodology-phases","Pt Methodology Phases",{"key":95,"name":96,"count":11},"pt-red-team-engagement-management","Pt Red Team Engagement Management",{"key":98,"name":99,"count":11},"pt-reporting-remediation-prioritization","Pt Reporting Remediation Prioritization",{"key":101,"name":102,"count":11},"pt-scoping-rules-of-engagement","Pt Scoping Rules Of Engagement",{"key":104,"name":105,"count":11},"pt-vulnerability-assessment-vs-pentest","Pt Vulnerability Assessment Vs Pentest",{"key":107,"name":108,"count":11},"security-authn-authz","Security Authn Authz",{"key":110,"name":111,"count":11},"security-cloud-infra-security","Security Cloud Infra Security",{"key":113,"name":114,"count":11},"security-compliance-risk","Security Compliance Risk",{"key":116,"name":117,"count":11},"security-cryptography-basics","Security Cryptography Basics",{"key":119,"name":120,"count":11},"security-incident-response","Security Incident Response",{"key":122,"name":123,"count":11},"security-network-security","Security Network Security",{"key":125,"name":126,"count":11},"security-secure-sdlc","Security Secure Sdlc",{"key":128,"name":129,"count":11},"security-web-vulnerabilities","Security Web Vulnerabilities",[131,135,138,141,144],{"key":132,"name":133,"count":134},"appsec","AppSec",450,{"key":136,"name":137,"count":134},"blue-team-incident","Blue Team \u002F Incident",{"key":139,"name":140,"count":134},"cloud-security","Cloud Security",{"key":142,"name":143,"count":134},"devsecops","DevSecOps",{"key":145,"name":146,"count":134},"offensive-pentest","Offensive \u002F Pentest",[148,166,179,193,206,219],{"id":149,"topic":9,"difficulty":150,"body":151,"options":152,"correct_key":160,"explanation":165},"019fab8f-ce07-720d-be73-1fd2b56afe7f",1,"In a typical CI\u002FCD security-gate pipeline, why is SAST usually placed before SCA and DAST rather than after them?",[153,156,159,162],{"key":154,"text":155},"a","SAST requires a fully deployed running instance, so it must come after every other gate",{"key":157,"text":158},"b","SAST is always the slowest gate, so teams schedule it last to avoid blocking fast checks",{"key":160,"text":161},"c","SAST only needs the source code, so it can run right after build, before an artifact exists",{"key":163,"text":164},"d","SAST replaces SCA and DAST entirely, so the other gates become optional","SAST analyzes source code or compiled artifacts directly, so it can execute right after the build step, well before an artifact is packaged for dependency scanning (SCA) or deployed for dynamic testing (DAST). Placing it early gives developers the fastest possible feedback.",{"id":167,"topic":9,"difficulty":150,"body":168,"options":169,"correct_key":157,"explanation":178},"019fab8f-ce08-7093-bcb7-a9f1eefdf98d","Why does SCA (software composition analysis) typically run against a resolved dependency manifest (e.g. a lockfile) rather than against raw source code?",[170,172,174,176],{"key":154,"text":171},"Lockfiles are always smaller, so they scan faster than any other pipeline artifact",{"key":157,"text":173},"The exact resolved versions of transitive dependencies are only known once the lockfile exists",{"key":160,"text":175},"Raw source code cannot be read by any automated tool without manual annotation",{"key":163,"text":177},"SCA tools are only compatible with binary artifacts, never with text files","SCA needs to know precisely which versions of direct and transitive dependencies will actually be pulled in, and that resolution only exists in the lockfile or manifest produced after dependency resolution, not in the raw import statements of the source.",{"id":180,"topic":9,"difficulty":181,"body":182,"options":183,"correct_key":154,"explanation":192},"019fab8f-ce08-7985-b3a9-e29457d90303",2,"A team runs DAST as the very last gate before production deploy, against a staging environment that mirrors production. A critical SQL injection is found at this stage. What is the main drawback of catching it only here, compared to catching it via SAST earlier in the pipeline?",[184,186,188,190],{"key":154,"text":185},"The fix now needs a full rebuild, re-running every earlier gate, and a fresh staging deploy",{"key":157,"text":187},"DAST findings are considered less reliable than SAST findings, so it might not be real",{"key":160,"text":189},"Staging environments are not permitted to run DAST scans under most frameworks",{"key":163,"text":191},"SQL injection cannot be detected by SAST tools under any circumstances","Because DAST sits at the end of the pipeline, a finding there forces the change to loop all the way back through build, SAST, and SCA again before a new staging deploy can be tested, whereas the same vulnerable pattern is often visible to SAST directly in the source right after the build gate, catching it far cheaper and earlier.",{"id":194,"topic":9,"difficulty":150,"body":195,"options":196,"correct_key":163,"explanation":205},"019fab8f-ce09-7924-b8da-43975203b61d","In a pipeline gate sequence of build -> SAST -> SCA -> DAST -> deploy, what is the primary reason DAST is placed after SCA rather than before it?",[197,199,201,203],{"key":154,"text":198},"DAST always produces more findings than SCA, so it runs second to balance report size",{"key":157,"text":200},"SCA needs internet access and DAST does not, so ordering follows network availability",{"key":160,"text":202},"Regulatory standards mandate dependency scanning before dynamic scanning everywhere",{"key":163,"text":204},"DAST needs a deployed artifact, so it makes sense to screen dependencies with SCA first","DAST requires an actual running instance of the application, which typically means packaging and deploying it to a test environment. It is more efficient to screen dependencies with SCA first, since finding a critical vulnerable library can fail the build before the team spends time and infrastructure deploying a DAST target.",{"id":207,"topic":9,"difficulty":181,"body":208,"options":209,"correct_key":157,"explanation":218},"019fab8f-ce0a-73ed-bb6d-e73e24bd6955","What is a key limitation of running every security gate strictly sequentially (build -> SAST -> SCA -> DAST -> deploy) rather than parallelizing independent gates where possible?",[210,212,214,216],{"key":154,"text":211},"Sequential gates are always cheaper to run in compute cost than parallel gates",{"key":157,"text":213},"Total feedback time is the sum of every gate's duration, even when SAST and SCA are independent",{"key":160,"text":215},"Sequential execution is required by every SAST and SCA vendor's licensing terms",{"key":163,"text":217},"Parallel gates cannot share a single build artifact, so each needs its own compile step","SAST and SCA are typically independent of each other's results (one analyzes source, the other analyzes the dependency manifest), so running them in parallel after the build step can cut total gate time roughly in half compared to running them one after another, without weakening the security coverage.",{"id":220,"topic":9,"difficulty":221,"body":222,"options":223,"correct_key":160,"explanation":232},"019fab8f-ce0a-7c75-ae67-3fe2484fe101",3,"A pipeline currently runs build -> SAST -> SCA -> DAST -> deploy fully sequentially, taking 40 minutes total. The team notices SAST and SCA are independent and each takes 8 minutes, while DAST depends on a deployed artifact and takes 20 minutes. What is the most sensible first change to reduce feedback time without weakening any gate?",[224,226,228,230],{"key":154,"text":225},"Remove SCA entirely, since SAST already covers first-party source code",{"key":157,"text":227},"Move DAST before SAST and SCA so the longest gate finishes first",{"key":160,"text":229},"Run SAST and SCA in parallel right after build, keeping DAST after both finish",{"key":163,"text":231},"Skip the build step for pull requests since only main needs a real build","Since SAST and SCA are independent, running them in parallel cuts roughly 8 minutes off the pipeline without removing any check or reordering DAST, which genuinely needs a deployed artifact and must still come after the source\u002Fdependency gates in this design.",{"fields":234,"seniorities":407,"interview_shapes":408,"locales":413,"oauth":415,"question_count":418,"coach_enabled":419,"jd_match_enabled":419},[235,260,280,296,320,333,352,371,381,388,394,401],{"key":236,"name_tr":237,"name_en":237,"sort":150,"specializations":238},"backend","Backend",[239,242,245,248,251,254,257],{"key":240,"name":241,"field":236},"general","Genel",{"key":243,"name":244,"field":236},"go","Go",{"key":246,"name":247,"field":236},"python","Python",{"key":249,"name":250,"field":236},"java","Java",{"key":252,"name":253,"field":236},"csharp","C#\u002F.NET",{"key":255,"name":256,"field":236},"nodejs","Node.js",{"key":258,"name":259,"field":236},"php","PHP",{"key":261,"name_tr":262,"name_en":262,"sort":181,"specializations":263},"frontend","Frontend",[264,265,268,271,274,277],{"key":240,"name":241,"field":261},{"key":266,"name":267,"field":261},"javascript","JavaScript",{"key":269,"name":270,"field":261},"typescript","TypeScript",{"key":272,"name":273,"field":261},"react","React",{"key":275,"name":276,"field":261},"vue","Vue",{"key":278,"name":279,"field":261},"angular","Angular",{"key":281,"name_tr":282,"name_en":282,"sort":221,"specializations":283},"fullstack","Fullstack",[284,285,286,287,288,289,290,291,292,293,294,295],{"key":240,"name":241,"field":281},{"key":243,"name":244,"field":236},{"key":246,"name":247,"field":236},{"key":249,"name":250,"field":236},{"key":252,"name":253,"field":236},{"key":255,"name":256,"field":236},{"key":258,"name":259,"field":236},{"key":266,"name":267,"field":261},{"key":269,"name":270,"field":261},{"key":272,"name":273,"field":261},{"key":275,"name":276,"field":261},{"key":278,"name":279,"field":261},{"key":297,"name_tr":298,"name_en":298,"sort":299,"specializations":300},"devops-cloud","DevOps \u002F Cloud",4,[301,302,305,308,311,314,317],{"key":240,"name":241,"field":297},{"key":303,"name":304,"field":297},"aws","AWS",{"key":306,"name":307,"field":297},"gcp","GCP",{"key":309,"name":310,"field":297},"azure","Azure",{"key":312,"name":313,"field":297},"kubernetes","Kubernetes",{"key":315,"name":316,"field":297},"terraform","Terraform",{"key":318,"name":319,"field":297},"linux","Linux",{"key":321,"name_tr":322,"name_en":322,"sort":323,"specializations":324},"ai-engineer","AI Engineer",5,[325,326,327,330],{"key":240,"name":241,"field":321},{"key":246,"name":247,"field":321},{"key":328,"name":329,"field":321},"llm-rag","LLM\u002FRAG",{"key":331,"name":332,"field":321},"mlops","MLOps",{"key":334,"name_tr":335,"name_en":336,"sort":337,"specializations":338},"database","Veritabanı","Database",6,[339,340,343,346,349],{"key":240,"name":241,"field":334},{"key":341,"name":342,"field":334},"postgresql","PostgreSQL",{"key":344,"name":345,"field":334},"mysql","MySQL",{"key":347,"name":348,"field":334},"mongodb","MongoDB",{"key":350,"name":351,"field":334},"redis","Redis",{"key":353,"name_tr":354,"name_en":355,"sort":356,"specializations":357},"mobile","Mobil","Mobile",7,[358,359,362,365,368],{"key":240,"name":241,"field":353},{"key":360,"name":361,"field":353},"ios-swift","iOS (Swift)",{"key":363,"name":364,"field":353},"android-kotlin","Android (Kotlin)",{"key":366,"name":367,"field":353},"flutter","Flutter",{"key":369,"name":370,"field":353},"react-native","React Native",{"key":5,"name_tr":372,"name_en":6,"sort":373,"specializations":374},"Güvenlik",8,[375,376,377,378,379,380],{"key":240,"name":241,"field":5},{"key":132,"name":133,"field":5},{"key":145,"name":146,"field":5},{"key":139,"name":140,"field":5},{"key":142,"name":143,"field":5},{"key":136,"name":137,"field":5},{"key":382,"name_tr":383,"name_en":384,"sort":385,"specializations":386},"qa-test-automation","QA \u002F Test Otomasyonu","QA \u002F Test Automation",9,[387],{"key":240,"name":241,"field":382},{"key":389,"name_tr":390,"name_en":390,"sort":391,"specializations":392},"data-engineer","Data Engineer",10,[393],{"key":240,"name":241,"field":389},{"key":395,"name_tr":396,"name_en":397,"sort":398,"specializations":399},"game-dev","Oyun Geliştirme","Game Development",11,[400],{"key":240,"name":241,"field":395},{"key":402,"name_tr":403,"name_en":403,"sort":404,"specializations":405},"ml-engineer","ML Engineer",12,[406],{"key":240,"name":241,"field":402},[14,15,16],{"junior":409,"mid":411,"senior":412},{"questions":410,"median_sec":3},20,{"questions":410,"median_sec":3},{"questions":410,"median_sec":3},[414,10],"tr",[416,417],"google","github",21750,true]