# CI/CD Pipeline Security (DevOps) > OIDC authentication, secrets management, SLSA provenance, minimal permissions, supply chain security - 20 interview questions - Mid-Level - [Interview Questions: DevOps](https://sharpskill.dev/en/technologies/devops/interview-questions.md) ## 1. What is OIDC (OpenID Connect) in the context of CI/CD pipelines? **Answer** OIDC is an authentication protocol that allows CI/CD pipelines to authenticate with cloud providers without using static secrets. Instead of storing long-lived credentials, the pipeline exchanges a signed JWT token for temporary credentials. This approach eliminates risks associated with storing and rotating secrets, while providing better traceability through token claims that precisely identify the workflow and repository. ## 2. What is the main advantage of External Secrets Operator in Kubernetes? **Answer** External Secrets Operator automatically synchronizes secrets from external managers (Vault, AWS Secrets Manager, Azure Key Vault) into native Kubernetes Secrets. This approach centralizes secret management in a dedicated system while allowing applications to consume secrets in a standard way. It also facilitates automatic secret rotation and avoids storing sensitive credentials directly in Kubernetes manifests or Git repositories. ## 3. What does the principle of least privilege mean in the context of CI/CD pipelines? **Answer** The principle of least privilege consists of granting pipelines only the permissions strictly necessary to accomplish their tasks. For example, a build pipeline should only have read rights on source code, while a deployment pipeline would only access resources in the target environment. This approach limits damage in case of pipeline compromise and reduces the overall attack surface of the infrastructure. ## 17 more questions available - What is an SBOM (Software Bill of Materials)? - Why use HashiCorp Vault rather than environment variables to store secrets? Sign up for free: https://sharpskill.dev/en/login ## Other DevOps interview topics - [Version Control & Git](https://sharpskill.dev/en/technologies/devops/interview-questions/version-control-git.md): 20 questions, Junior - [Linux Fundamentals](https://sharpskill.dev/en/technologies/devops/interview-questions/linux-fundamentals.md): 22 questions, Junior - [Shell Scripting & Bash](https://sharpskill.dev/en/technologies/devops/interview-questions/shell-scripting-bash.md): 20 questions, Mid-Level - [Networking Basics](https://sharpskill.dev/en/technologies/devops/interview-questions/networking-basics.md): 22 questions, Junior - [Docker Fundamentals](https://sharpskill.dev/en/technologies/devops/interview-questions/docker-fundamentals.md): 24 questions, Junior - [CI/CD Fundamentals](https://sharpskill.dev/en/technologies/devops/interview-questions/ci-cd-fundamentals.md): 18 questions, Junior - [GitHub Actions](https://sharpskill.dev/en/technologies/devops/interview-questions/github-actions.md): 22 questions, Mid-Level - [GitLab CI/CD](https://sharpskill.dev/en/technologies/devops/interview-questions/gitlab-ci.md): 22 questions, Mid-Level - [Jenkins](https://sharpskill.dev/en/technologies/devops/interview-questions/jenkins.md): 22 questions, Mid-Level - [Kubernetes Basics](https://sharpskill.dev/en/technologies/devops/interview-questions/kubernetes-basics.md): 26 questions, Mid-Level - [Kubernetes Networking](https://sharpskill.dev/en/technologies/devops/interview-questions/kubernetes-networking.md): 24 questions, Mid-Level - [Kubernetes Advanced](https://sharpskill.dev/en/technologies/devops/interview-questions/kubernetes-advanced.md): 24 questions, Mid-Level - [Ingress & API Gateway](https://sharpskill.dev/en/technologies/devops/interview-questions/ingress-api-gateway.md): 20 questions, Mid-Level - [Terraform Basics](https://sharpskill.dev/en/technologies/devops/interview-questions/terraform-basics.md): 22 questions, Mid-Level - [Terraform Advanced](https://sharpskill.dev/en/technologies/devops/interview-questions/terraform-advanced.md): 22 questions, Mid-Level - [Ansible & Configuration Management](https://sharpskill.dev/en/technologies/devops/interview-questions/ansible-configuration.md): 20 questions, Mid-Level - [AWS Essentials](https://sharpskill.dev/en/technologies/devops/interview-questions/aws-essentials.md): 26 questions, Mid-Level - [Azure Fundamentals](https://sharpskill.dev/en/technologies/devops/interview-questions/azure-fundamentals.md): 22 questions, Mid-Level - [GCP Fundamentals](https://sharpskill.dev/en/technologies/devops/interview-questions/gcp-fundamentals.md): 22 questions, Mid-Level - [Monitoring & Prometheus](https://sharpskill.dev/en/technologies/devops/interview-questions/monitoring-prometheus.md): 22 questions, Mid-Level - [Logging & ELK Stack](https://sharpskill.dev/en/technologies/devops/interview-questions/logging-elk.md): 20 questions, Mid-Level - [Alerting & Incident Response](https://sharpskill.dev/en/technologies/devops/interview-questions/alerting-incident-response.md): 20 questions, Mid-Level - [Cloud Identity & Secrets](https://sharpskill.dev/en/technologies/devops/interview-questions/cloud-identity-secrets.md): 22 questions, Mid-Level - [Helm & Kubernetes](https://sharpskill.dev/en/technologies/devops/interview-questions/helm-kubernetes.md): 20 questions, Mid-Level - [Runtime & Cluster Security](https://sharpskill.dev/en/technologies/devops/interview-questions/runtime-cluster-security.md): 24 questions, Senior - [Container Supply Chain Security](https://sharpskill.dev/en/technologies/devops/interview-questions/container-supply-chain.md): 22 questions, Senior - [Service Mesh & Istio](https://sharpskill.dev/en/technologies/devops/interview-questions/service-mesh-istio.md): 24 questions, Senior - [GitOps & ArgoCD](https://sharpskill.dev/en/technologies/devops/interview-questions/gitops-argocd.md): 22 questions, Senior - [Progressive Delivery](https://sharpskill.dev/en/technologies/devops/interview-questions/progressive-delivery.md): 20 questions, Senior - [Distributed Observability](https://sharpskill.dev/en/technologies/devops/interview-questions/observability-distributed.md): 22 questions, Senior - [Disaster Recovery & Backup](https://sharpskill.dev/en/technologies/devops/interview-questions/disaster-recovery.md): 20 questions, Senior - [Performance Optimization](https://sharpskill.dev/en/technologies/devops/interview-questions/performance-optimization.md): 22 questions, Senior - [Cloud Cost Optimization](https://sharpskill.dev/en/technologies/devops/interview-questions/infrastructure-cost.md): 20 questions, Senior - [SRE Principles](https://sharpskill.dev/en/technologies/devops/interview-questions/sre-principles.md): 24 questions, Senior - [Chaos Engineering](https://sharpskill.dev/en/technologies/devops/interview-questions/chaos-engineering.md): 20 questions, Senior - [Platform Engineering](https://sharpskill.dev/en/technologies/devops/interview-questions/platform-engineering.md): 22 questions, Senior --- Source: SharpSkill (https://sharpskill.dev), tech interview preparation for your real stack. HTML version of this page: https://sharpskill.dev/en/technologies/devops/interview-questions/cicd-pipeline-security