5.0 DevOps Fundamentals CV0-004 Practice Quiz

• A. Managing the version numbers displayed in application user interfaces
• B. Tracking all changes to code, configuration, and infrastructure over time using a version control system, enabling teams to see the full history of changes, who made them, why they were made, and the ability to revert to any previous state
• C. Managing software license versions for cloud-deployed applications
• D. Controlling which version of the cloud provider's API the application uses

Version management through systems like Git maintains a complete, auditable history of all code and configuration changes, who changed what, when, and with what justification, enabling rollback, parallel development, and change tracking. This is the correct answer.

• A. To measure how fast developers write code for performance evaluations
• B. To have one or more peers examine code changes before they are merged, catching bugs, security vulnerabilities, design issues, and policy violations that the author may have missed, while also spreading knowledge across the team
• C. To format code according to style guidelines automatically
• D. To compile and run code to verify it executes without errors

Code review is a peer quality gate, reviewers catch logic errors, security vulnerabilities (hardcoded credentials, SQL injection, insecure API calls), architectural issues, and policy violations before code reaches production, while simultaneously distributing knowledge of the codebase across the team. This is the correct answer.

• A. Git automatically reverts failed deployments without human intervention
• B. Git's complete history of all commits allows the team to identify the last known-good commit, use `git revert` to create a new commit undoing the breaking changes, or `git checkout` to roll back to a previous state, enabling rapid, controlled rollback without losing the change history of what was attempted
• C. Version management only tracks files, it cannot help with production rollback
• D. The team must contact the cloud provider to restore the previous application version

Git's immutable commit history makes rollback straightforward: identify the last stable commit, use revert (adds a new commit undoing changes, preserving history) or reset (moves HEAD pointer back, potentially losing history), then redeploy, enabling rapid recovery from broken deployments. This is the correct answer.

• A. Approve the pull request since the connection string is needed for the application to work
• B. Block the pull request, document the security finding, require the developer to move the connection string to a secrets manager or environment variable, and verify the corrected approach before approval, code review is a critical security gate that must prevent hardcoded credentials from reaching the codebase
• C. Ask the developer to encrypt the connection string before hardcoding it
• D. Leave a comment but approve since fixing secrets is the security team's job

Code reviewers are responsible for blocking security vulnerabilities, hardcoded credentials are a critical security finding that must be rejected. The reviewer blocks the PR, documents the issue, requires remediation using secrets management, and verifies the fix before approving. This is the correct answer.

• A. Only spell-checking commit messages
• B. Automated unit and integration tests, static code analysis (linting, SAST), security scanning for credentials and known vulnerabilities, code coverage thresholds, IaC validation (terraform plan/validate), and container image scanning for base image CVEs, collectively ensuring functional correctness, security, and compliance before any human review
• C. Only checking that the PR has a description
• D. Only verifying the branch name follows naming conventions

Comprehensive PR automation validates multiple dimensions: functional correctness (tests), code quality (linting), security (SAST, credential scanning), coverage (regression detection), infrastructure validity (IaC validation), and container security (image scanning), all automated before human review focuses on logic and design. This is the correct answer.

• A. Increment MAJOR (e.g., 2.0.0) to signal the new feature's importance
• B. Increment MINOR (e.g., 1.3.0 → 1.4.0), new backward-compatible features increment the MINOR version. MAJOR increments for breaking changes, MINOR for backward-compatible features, and PATCH for backward-compatible bug fixes
• C. Increment PATCH (e.g., 1.3.0 → 1.3.1) since no existing behavior changed
• D. The version number does not change for new features, only for bug fixes

SemVer convention: MAJOR.MINOR.PATCH, MAJOR for breaking changes, MINOR for backward-compatible new features, PATCH for backward-compatible bug fixes. A new backward-compatible feature increments MINOR. This is the correct answer.

• A. Git version management cannot be used for IaC templates, only for application code
• B. Direct commits to the main branch bypassed the code review process. IaC changes must follow the same pull request, review, and approval workflow as application code. Branch protection rules should prevent direct commits to main, requiring all changes to go through pull requests with required reviewers
• C. The version history accurately recorded the change, no governance failure occurred
• D. IaC changes should be applied directly to main since they are configuration, not code

Direct commits to main branches bypass the peer review safety net that catches errors before production impact. Branch protection rules with required pull requests and reviewer approvals prevent this, the same governance applied to application code must apply to IaC changes that directly affect production infrastructure. This is the correct answer.

• A. Reduce the number of required reviewers to speed up the process
• B. Implement review quality measures: require reviewers to leave at least one substantive comment, set minimum review time thresholds, rotate reviewer assignments to prevent approval collusion, use automated pre-review checks (linting, security scanning, test coverage) to surface issues before human review, and include review quality in team health metrics
• C. Remove code review requirements since they are not adding value
• D. Have only one senior engineer review all code to ensure quality

Rubber-stamp reviews require systemic fixes: substantive comment requirements, time thresholds (reviewers who approve in <60 seconds have not read the code), rotation to prevent buddy-approval patterns, automated pre-checks to focus human attention on logic rather than formatting, and accountability through quality metrics. This is the correct answer.