Devsecops interview questions

Hello all, I gave a devsecops interview recently and wanted to share type of questions asked by interviewer. It was a good 30 minutes of interview.

Encryption algorithms What is Symmetric, Asymmetric, hashing, encoding? What is the difference between above? Which one is more secure? Why do we still use symmetric and not only hashing or Asymmetric if its more secure than symmetric?

What is transitive dependency in devsecops?

How do you integrate security tools in jenkins? Explain the processes/stage included.

What is sql injection and how can you prevent it?

What is XSS and how can you prevent it?

What is the process of threat modelling you followed?

How did you make sure that team is adhering to threat modelling framework?

In SCA scan the tool has given that spring jcl 1.0.0 dependency is missing..but its not present in pom.xml is this a false positive or not?

How can you find correct libraries to fix vulnerabilities? Example: there maybe hundreds of libraries for an application.

In transitive dependency how can you find out the correct parent library to update ?

Explain me any type of vulnerabilities (high low medium)you have worked on and fixed while working in devsecops.

What is the secure approach dev team can use to store passwords?