DevOps vs. DevSecOps DSE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company is transitioning from DevOps to DevSecOps. The security team currently works in a separate department and only interacts with developers during final release reviews. The developers feel that security is a bottleneck. What cultural change is needed to eliminate this bottleneck?

   • AThe security team should be given more authority to reject releases.
   • BSecurity engineers should work directly with development teams and be involved from the start of the development process.
   • CThe security team should move to a different office to reduce interruptions.
   • DDevelopers should be allowed to bypass security checks when deadlines are tight.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company has separate development, operations, and security teams. They want to move to a DevSecOps model. Which cultural change is most critical for success?

   • ACreating a new security policy document and requiring all employees to sign it.
   • BHiring more security engineers to handle the increased workload.
   • CFostering a culture of shared responsibility where security is everyone's concern, not just the security team's.
   • DMoving the security team to a different office to reduce conflicts with developers.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company's DevOps team delivers features quickly, but security vulnerabilities are often found only after production incidents. Management asks the team to adopt DevSecOps. What is the most significant change they should expect?

   • ASecurity activities will shift from post-deployment to earlier in the pipeline, with automated checks and shared responsibility.
   • BThe security team will take over the CI/CD pipeline and approve every change.
   • CThe company will need to purchase a commercial vulnerability scanner to be compliant.
   • DThe team will need to slow down deployments to allow for manual security testing.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company is adopting DevSecOps. The security team is concerned that developers will ignore security findings if they are not enforced. The development team is concerned that strict enforcement will slow down delivery. The company has a compliance requirement to fix critical vulnerabilities before deployment. Which approach best balances these concerns?

   • AConfigure the CI/CD pipeline to fail the build on critical vulnerabilities, but allow non-critical findings to be logged and tracked for remediation in a backlog.
   • BHave the security team manually approve every release after reviewing all findings.
   • CSet the pipeline to fail on any vulnerability, regardless of severity.
   • DAllow all vulnerabilities to be deployed and rely on the security team to fix them after deployment.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company is transitioning from a traditional DevOps model where the security team performs penetration tests only at the end of each release cycle. The CISO wants to adopt DevSecOps to reduce the time between vulnerability discovery and remediation. Which outcome is the most direct benefit of this transition?

   • AThe security team no longer needs to perform any testing because automated tools replace all manual reviews.
   • BSecurity issues are identified and fixed earlier in the development lifecycle, reducing the cost and effort of remediation.
   • CThe development team can ignore security requirements because the pipeline handles everything automatically.
   • DThe company can guarantee that no vulnerabilities will ever reach production.
   Reveal Solution Discussion Select an answer first