Title: Quiz 7 — A CI/CD Pipeline for Your Capstone
Course: AIINFRA 303: Capstone Project > Section: Week 07 — A CI/CD Pipeline for Your Capstone

Q: Which practice automatically deploys every change that passes the pipeline to production, with no manual approval step?
- Continuous Integration
- Continuous Delivery
- Continuous Deployment
- Continuous Monitoring
A: Continuous Deployment

Q: Continuous Integration means only that code is merged frequently — it does not require an automated build or test run.
- True
- False
A: False

Q: List the four canonical pipeline stages, in order, that precede the monitoring feedback loop.
Feedback: Sample/expected answer: Source, Build, Test, Deploy

Q: What is the recommended way to authenticate a GitHub Actions workflow to a cloud provider (e.g., to deploy infrastructure), rather than storing a long-lived access key as a secret?
- Paste the access key directly into the workflow YAML
- Store the access key in a repository Secret and reference it every run
- Use OpenID Connect (OIDC) to obtain a short-lived, automatically expiring token
- Email the credentials to yourself as a backup
A: Use OpenID Connect (OIDC) to obtain a short-lived, automatically expiring token

Q: A monolithic pipeline that runs lint, unit tests, integration tests, and deploy serially in a single job gives faster feedback than breaking those into independent, parallel jobs.
- True
- False
A: False

Q: In the lab's GitHub Actions workflow, which action is used to build and push the Docker image with GHA layer caching enabled?
- `actions/checkout@v4`
- `docker/build-push-action` with `cache-from`/`cache-to` set to `type=gha`
- `docker/login-action`
- `actions/setup-python@v5`
A: `docker/build-push-action` with `cache-from`/`cache-to` set to `type=gha`

Q: Why is it dangerous to hardcode a credential directly in a workflow YAML file, even if you plan to delete it in a later commit?
Feedback: Sample/expected answer: Because it becomes part of the git history permanently — once committed, the credential is exposed and should be considered compromised even after deletion; use the CI's native secret store (or a secrets manager) instead.

Q: Building security checks (like dependency and secret scanning) into the pipeline itself, rather than treating security as a separate post-deployment audit, is a core DevSecOps practice.
- True
- False
A: True