Explain how you would set up automated security scanning in CI.

security scanning
SAST
dependency scanning
DevSecOps

Your answer

Answer it first, then compare. Nothing here is saved or scored.

Model answer

Layers of security scanning: (1) Static Analysis (SAST): scan code for vulnerabilities (Semgrep, SonarQube, CodeQL). (2) Dependency scanning: check for known CVEs (npm audit, Dependabot, Snyk). (3) Secret detection: prevent committed secrets (TruffleHog, GitLeaks). (4) Container scanning: scan Docker images (Trivy, Snyk Container). (5) DAST: dynamic testing against running application (OWASP ZAP). Run SAST and dependency scanning on every PR (fast). Run DAST nightly (slow). Block merges on critical/high vulnerabilities.

What interviewers listen for

Pipeline shape
You design stages by failure cost and runtime budget, not by tool feature lists.
Parallelisation craft
You can shard a real suite and explain the state-isolation choices you made.
Quality gates
You know which checks block merge, which warn, and why those defaults are correct.
Shift-left fluency
You talk about ownership transfer, not just earlier execution.

See all 34 ci/cd questions