Microsoft DevOps Engineer Expert: key terms

Flashcards for this exam Microsoft DevOps Engineer Expert guide

• A/B TestingExperimentation that serves different variants to user groups and compares business metrics to decide which performs better.Foundational
• Application InsightsAzure Monitor feature for application performance monitoring (APM), including requests, dependencies, exceptions and availability tests.Intermediate
• Application Performance Monitoring (APM)Tooling that instruments applications to track transaction performance, errors, dependencies, and resource usage.Foundational
• Approval GateA pipeline checkpoint that pauses deployment until a person approves or an automated condition is met.Foundational
• Artifact RepositoryA service that stores and versions build outputs and dependency packages, such as Nexus, Artifactory, Azure Artifacts, AWS CodeArtifact, or GitHub Packages.Intermediate
• Azure DevOpsMicrosoft's suite of developer services: Azure Boards, Repos, Pipelines, Test Plans, and Artifacts.Foundational
• Azure PipelinesThe CI/CD service in Azure DevOps that builds, tests, and deploys code using YAML or classic pipelines on Microsoft-hosted or self-hosted agents.Foundational
• Azure Resource Manager Template (ARM template)A JSON file that declaratively defines Azure resources for deployment through Azure Resource Manager.Intermediate
• Behavior-Driven Development (BDD)A practice that describes system behavior in plain-language scenarios, typically Given/When/Then, that become automated acceptance tests.Intermediate
• BicepMicrosoft's domain-specific language for declaratively deploying Azure resources, which transpiles to ARM JSON templates.Intermediate
• Blameless PostmortemA written review of an incident that focuses on systemic causes and improvements rather than assigning individual fault.Foundational
• Blue-Green DeploymentA release strategy using two identical production environments, switching all traffic from the current (blue) to the new (green) version at once.Intermediate
• BranchA movable pointer to a commit that represents an independent line of development in Git.Foundational
• Branch Protection RuleRepository settings that enforce policies on important branches, such as required reviews, status checks, and no force pushes.Foundational
• Build ArtifactA versioned output of a build, such as a compiled binary, package, or container image, that is promoted through environments.Foundational
• Build CacheReusing previously downloaded dependencies or build outputs between pipeline runs to speed up builds.Intermediate
• Build Once, Deploy ManyThe principle that a single immutable build artifact is created once and promoted unchanged to every environment.Foundational
• Build ProvenanceVerifiable metadata describing how, where, when and from what sources a software artifact was built.Advanced
• CALMS FrameworkA DevOps maturity model covering Culture, Automation, Lean, Measurement, and Sharing.Foundational
• Canary DeploymentReleasing a new model to a small fraction of traffic first, then increasing gradually if metrics are healthy.Intermediate
• Change Failure Rate (CFR)A DORA metric measuring the percentage of deployments that cause a failure in production requiring remediation.Foundational
• Chaos EngineeringThe discipline of experimenting on a system by injecting controlled failures to build confidence in its resilience.Intermediate
• CheckovAn open-source IaC static analysis tool (from Prisma Cloud by Palo Alto Networks) that scans Terraform, CloudFormation, Kubernetes, Helm, Dockerfiles and more.Intermediate
• CI/CD PipelineAn automated sequence of stages that takes code from commit through build, test, and deployment.Foundational
• Code CoverageThe percentage of code executed by automated tests, measured by lines, branches, or functions.Foundational
• Code ReviewSystematic examination of source code changes by peers to find defects, improve quality, and share knowledge.Foundational
• CodeQLGitHub's semantic code analysis engine that queries code like data to find security vulnerabilities, used for code scanning.Intermediate
• CommitA snapshot of tracked changes in a Git repository, with an author, message, timestamp, and pointer to its parent commit(s).Foundational
• Configuration DriftDivergence between the actual configuration of a system and its intended, documented, or code-defined state.Intermediate
• Container Image HardeningBuilding container images with minimal contents, non-root users and no secrets to reduce attack surface.Intermediate
• Container Image ScanningScanning container images for vulnerable OS packages and libraries, misconfigurations, secrets and malware before and after deployment.Intermediate
• Container RegistryA service that stores and distributes container images, such as Docker Hub, Amazon ECR, Azure Container Registry, Google Artifact Registry, Quay, or Harbor.Foundational
• Continuous Delivery (CD)The practice of keeping software always in a releasable state, with every change automatically built, tested, and deployable to production on demand.Foundational
• Continuous DeploymentThe practice of automatically releasing every change that passes all pipeline stages to production without human intervention.Foundational
• Continuous Integration (CI)The practice of merging code changes into a shared branch frequently, with each change automatically built and tested.Foundational
• Continuous Integration SecurityProtecting CI/CD systems, runners, secrets and pipeline definitions from tampering and misuse.Intermediate
• CosignSigstore's command-line tool for signing, verifying and attaching attestations to container images and other OCI artifacts.Advanced
• CycloneDXAn OWASP SBOM standard (ECMA-424) designed for security use cases, supporting software, hardware, services, cryptographic assets and VEX data.Intermediate
• Dark LaunchDeploying a feature to production while hiding it from users, so it can be tested with real traffic or infrastructure before release.Intermediate
• Declarative ConfigurationSpecifying the desired end state of a system and letting a tool determine the steps to reach it.Foundational
• DependabotA GitHub feature that alerts on vulnerable dependencies and automatically opens pull requests to update them.Foundational
• Dependency ConfusionA supply chain risk in which a package manager installs a malicious public package instead of an internal private package with the same name.Intermediate
• Dependency ManagementDeclaring, resolving, pinning, and updating the external libraries an application relies on.Foundational
• Dependency PinningSpecifying exact versions (and ideally cryptographic hashes) of dependencies so builds use known, reviewed components.Intermediate
• Deployment FrequencyA DORA metric measuring how often an organization successfully deploys code to production.Foundational
• Deployment SlotLive App Service environment with its own hostname used to stage a new version and swap it into production with no downtime.Intermediate
• DevOpsA culture and set of practices that unify software development and IT operations to deliver changes quickly, safely, and reliably.Foundational
• DevSecOpsThe integration of security practices and automated security testing into every stage of the DevOps pipeline.Intermediate
• Distributed TracingTracking a single request as it flows across multiple services by propagating a trace context and recording timed spans.Intermediate
• DORA MetricsFour key software delivery metrics from the DevOps Research and Assessment program: deployment frequency, lead time, change failure rate, and recovery time.Intermediate
• Dynamic Application Security Testing (DAST)Testing a running application from the outside by sending crafted requests to find vulnerabilities.Intermediate
• End-to-End Test (E2E)An automated test that validates a complete user workflow through the entire application stack.Foundational
• Environment PromotionMoving the same tested artifact through successive environments such as dev, test, staging, and production.Foundational
• Ephemeral EnvironmentA short-lived, automatically created environment for testing a branch or pull request, destroyed after use.Intermediate
• Error BudgetThe allowable amount of unreliability for a service, equal to 100% minus the SLO, which teams can spend on releases and risk.Intermediate
• Failed Deployment Recovery TimeA DORA metric, formerly called time to restore service (MTTR), measuring how long it takes to recover from a failed deployment.Intermediate
• Feature BranchA branch created to develop a specific feature or fix in isolation before merging it back into the main branch.Foundational
• Feature FlagA runtime switch that enables or disables functionality without deploying new code, also called a feature toggle.Intermediate
• Flaky TestAn automated test that passes and fails intermittently without code changes.Intermediate
• FluxA CNCF graduated GitOps toolkit that keeps Kubernetes clusters in sync with configuration sources such as Git repositories and OCI artifacts.Intermediate
• GitA free, open-source distributed version control system that tracks changes to files and enables collaborative development.Foundational
• git cherry-pickA Git command that applies the changes from a specific existing commit onto the current branch as a new commit.Intermediate
• Git Large File Storage (Git LFS)A Git extension that stores large binary files outside the repository, replacing them with small pointer files.Intermediate
• git revertA Git command that creates a new commit that undoes the changes made by a previous commit.Foundational
• Git SubmoduleA repository embedded inside another Git repository at a specific commit.Advanced
• Git TagA named reference to a specific commit, typically used to mark release versions.Foundational
• GitFlowA branching model with long-lived main and develop branches plus feature, release, and hotfix branches.Intermediate
• GitHubA cloud platform for hosting Git repositories with collaboration, code review, CI/CD (Actions), package hosting, and security features.Foundational
• GitHub ActionsGitHub's integrated CI/CD and automation platform that runs YAML-defined workflows in response to repository events.Foundational
• GitHub Advanced Security (GHAS)GitHub's security product suite including code scanning, secret scanning with push protection, and dependency review.Intermediate
• GitHub FlowA lightweight branching workflow: create a branch from main, commit, open a pull request, review, merge, and deploy.Foundational
• GitOpsAn operating model where desired infrastructure and app state is stored declaratively in Git and automatically reconciled to the live environment.Intermediate
• HotfixAn urgent fix applied to production to resolve a critical defect, usually outside the normal release cadence.Foundational
• Image ScanningAnalyzing container images for known vulnerabilities, misconfigurations, secrets, and license issues.Intermediate
• Image SigningCryptographically signing container images so deployment systems can verify their origin and integrity before running them.Intermediate
• Immutable InfrastructureAn approach where servers or containers are never modified after deployment; changes are made by replacing them with new instances built from a new image.Intermediate
• Infrastructure as Code (IaC)Managing and provisioning infrastructure through machine-readable definition files rather than manual configuration.Foundational
• Infrastructure as Code ScanningStatic analysis of Terraform, CloudFormation, Kubernetes manifests, Helm charts and similar templates for security misconfigurations before deployment.Intermediate
• Infrastructure PipelineA CI/CD pipeline that validates, plans, and applies infrastructure as code changes.Intermediate
• Integration TestAn automated test that verifies multiple components or services work together correctly.Foundational
• Interactive Application Security Testing (IAST)Security testing that uses agents instrumented inside a running application to observe code execution and data flow during functional tests.Intermediate
• JenkinsA widely used open-source automation server for building CI/CD pipelines, extended through thousands of plugins.Foundational
• JobIn CI/CD, a set of steps that execute on the same runner; in GitHub Actions jobs run in parallel unless linked with needs.Foundational
• KanbanA flow-based work management method that visualizes work on a board, limits work in progress, and manages flow.Foundational
• Kusto Query Language (KQL)A read-only query language used in Azure Monitor Log Analytics, Application Insights, Microsoft Sentinel, and Azure Data Explorer.Intermediate
• Lead Time for ChangesA DORA metric measuring the time from code being committed to that code running successfully in production.Foundational
• LintingAutomated static checking of source code or configuration for style issues, errors, and suspicious constructs.Foundational
• Log AggregationCollecting logs from many systems into a central store for search, correlation, retention, and alerting.Foundational
• Malicious PackageAn open-source package intentionally published or modified to perform harmful actions such as stealing credentials or installing backdoors.Intermediate
• MergeCombining the changes from one Git branch into another, creating a merge commit when histories have diverged.Foundational
• Merge ConflictA situation where Git cannot automatically combine changes because the same part of a file was modified differently in both branches.Foundational
• Microsoft Threat Modeling ToolA free Microsoft application for drawing DFDs and automatically generating STRIDE-based threats.Intermediate
• MonitoringCollecting, aggregating, and alerting on predefined metrics and checks to detect known failure conditions.Foundational
• MonorepoA single repository that contains code for many projects or services.Intermediate
• ObservabilityThe ability to understand a system's internal state from its external outputs, typically metrics, logs, and traces.Foundational
• Open Source License ComplianceEnsuring that use of open-source components follows the obligations of their licenses.Intermediate
• OpenID Connect for CI/CD (OIDC)Using short-lived OIDC tokens issued by a CI platform to authenticate to cloud providers without storing long-lived credentials.Advanced
• OpenTelemetry (OTel)A CNCF open standard and set of SDKs, APIs, and a collector for generating and exporting metrics, logs, and traces vendor-neutrally.Intermediate
• OWASP DevSecOps Maturity Model (DSOMM)An OWASP model that defines security activities for DevOps pipelines and rates their implementation across maturity levels.Advanced
• OWASP Top 10 CI/CD Security RisksAn OWASP list of the ten most significant security risks in CI/CD environments.Advanced
• Pipeline as CodeDefining CI/CD pipelines in version-controlled files, usually YAML, stored alongside application code.Foundational
• Platform EngineeringThe discipline of building and running internal self-service platforms that give developers paved paths to build, deploy, and operate software.Intermediate
• Poisoned Pipeline Execution (PPE)A CI/CD risk in which an attacker who can modify pipeline configuration or build scripts gets malicious commands executed by the build system.Advanced
• Policy as CodeExpressing security, compliance, and operational policies in code that is versioned and automatically evaluated.Intermediate
• PowerShell Desired State Configuration (DSC)A Microsoft declarative configuration management platform for defining and enforcing the configuration of Windows and cross-platform systems.Advanced
• Pull Request (PR)A request to merge changes from one branch into another, providing a place for code review, discussion, and automated checks.Foundational
• Quality GateA set of automated pass/fail criteria, such as test pass rate, coverage, or vulnerability thresholds, that a build must meet to proceed.Intermediate
• RebaseReapplying commits from one branch on top of another base commit, producing a linear history.Intermediate
• Regression TestRe-running tests after a change to ensure previously working functionality still works.Foundational
• Release PipelineThe portion of a delivery pipeline responsible for deploying approved artifacts to environments and managing releases.Foundational
• RepositoryA storage location that holds a project's files and their complete version history in a version control system.Foundational
• RollbackReverting a system to a previous known-good version after a failed or problematic change.Foundational
• Rolling DeploymentA release strategy that gradually replaces instances of the old version with the new version in batches.Foundational
• RunnerA machine or container that executes CI/CD jobs, called a runner in GitHub Actions and GitLab and an agent in Azure Pipelines and Jenkins.Foundational
• SAST False Positive ManagementProcesses for triaging, suppressing and tuning static analysis results so developers trust and act on findings.Intermediate
• Secret ScanningAutomatically detecting credentials such as API keys, tokens, and passwords committed to source repositories.Intermediate
• Secrets ManagementSecurely storing, distributing, rotating, and auditing credentials such as passwords, API keys, and certificates.Foundational
• Security ChampionA developer or engineer embedded in a product team who acts as the team's security advocate and liaison to the security group.Foundational
• Security DebtAccumulated unresolved security flaws and deferred security work in software, which increase risk over time.Foundational
• Security GateA checkpoint in the SDLC or CI/CD pipeline where defined security criteria must be met before work proceeds.Foundational
• Security Regression TestingRe-running security tests after changes to confirm that previously fixed vulnerabilities have not returned.Foundational
• Security User StoryAn agile user story written to capture a security requirement, often from the viewpoint of a defender or attacker.Foundational
• Semantic Versioning (SemVer)A versioning scheme of MAJOR.MINOR.PATCH where major indicates breaking changes, minor adds compatible features, and patch fixes bugs.Foundational
• SemgrepAn open-source, pattern-based static analysis tool that scans code for bugs and security issues using rules that resemble source code.Intermediate
• Service ConnectionAn Azure DevOps object that securely stores credentials pipelines use to access external services such as Azure subscriptions, registries, or Kubernetes.Intermediate
• Service Level Agreement (SLA)Contractual commitment from a provider defining service availability or performance targets and remedies if they are missed.Foundational
• Service Level Indicator (SLI)A quantitative measure of some aspect of a service's level of service, such as request latency, error rate, or availability.Foundational
• Service Level Objective (SLO)A target value or range for an SLI over a time window, such as 99.9% of requests succeeding over 30 days.Foundational
• Shift LeftThe practice of moving testing, security, and quality activities earlier in the software delivery lifecycle.Foundational
• Shift-Right TestingTesting and validating software in production using monitoring, canaries, feature flags, chaos experiments, and real user data.Intermediate
• SigstoreAn open-source project (OpenSSF) providing free tooling and public infrastructure for signing and verifying software artifacts.Advanced
• Site Reliability Engineering (SRE)A discipline, created at Google, that applies software engineering to operations problems to build scalable and highly reliable systems.Foundational
• SLSA Build LevelsThe graded levels of the SLSA Build track that describe increasing guarantees about how an artifact was built.Advanced
• Smoke TestA quick, shallow test run after a build or deployment to confirm the most critical functions work.Foundational
• Software Bill of Materials (SBOM)A formal, machine-readable inventory of all components and dependencies in a piece of software.Intermediate
• Software Composition Analysis (SCA)Identifying open-source and third-party dependencies in software and checking them for known vulnerabilities and license issues.Intermediate
• Software Package Data Exchange (SPDX)An open standard (ISO/IEC 5962:2021) from the Linux Foundation for communicating SBOM information, including components, licenses and relationships.Intermediate
• Software Supply Chain FailuresOWASP Top 10 2025 category (A03) for compromises or weaknesses in dependencies, build systems and distribution infrastructure.Intermediate
• Software Supply Chain SecurityProtecting the integrity, provenance and security of all code, dependencies, tools and processes used to build and deliver software.Intermediate
• SonarQubeA code quality and security platform (from SonarSource) that performs static analysis for bugs, code smells, vulnerabilities and security hotspots.Intermediate
• Squash MergeCombining all commits from a branch into a single new commit on the target branch.Intermediate
• Static Application Security Testing (SAST)Analyzing source code, bytecode, or binaries for security vulnerabilities without executing the application.Intermediate
• Synthetic MonitoringProactively testing an application by running scripted transactions or probes from external locations at regular intervals.Intermediate
• Technical DebtThe implied future cost of rework caused by choosing quick or limited solutions now instead of better approaches.Foundational
• TerraformHashiCorp's infrastructure as code tool that provisions resources across many providers using declarative HCL configuration.Foundational
• Test PyramidA testing strategy model recommending many fast unit tests, fewer integration tests, and very few end-to-end tests.Intermediate
• Test-Driven Development (TDD)A development practice of writing a failing test first, writing just enough code to pass it, then refactoring (red-green-refactor).Intermediate
• Threat Modeling as CodeDefining system models and threat rules in code or structured files stored with the application, so threat models are versioned and generated automatically.Advanced
• Three Ways of DevOpsThe principles from The Phoenix Project and The DevOps Handbook: flow, feedback, and continual learning and experimentation.Intermediate
• TrivyAn open-source security scanner from Aqua Security for container images, file systems, Git repositories, Kubernetes and IaC.Intermediate
• Trunk-Based DevelopmentA branching model where developers integrate small changes into a single main branch (trunk) at least daily.Intermediate
• Unit TestAn automated test that verifies a small, isolated piece of code, such as a function or class, independent of external dependencies.Foundational
• Value Stream Mapping (VSM)A Lean technique that visualizes every step, wait time, and handoff required to deliver a change from request to customer.Intermediate