DevOps vs. DevSecOps DSE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company has a DevOps pipeline that automates testing and deployment. The security team is not involved until after deployment, and they have found several vulnerabilities in production. The company wants to adopt DevSecOps but is concerned about the cost of new tools and training. Which approach provides the most value for the least additional cost?

   • AStart by integrating open-source security scanning tools into the existing CI/CD pipeline and provide developers with a short training session on interpreting and fixing common findings.
   • BWait until the next budget cycle to implement any security improvements.
   • CHire additional security staff to manually review all code changes.
   • DPurchase an expensive enterprise security platform that automates all security checks.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A DevOps team is proud of its automated CI/CD pipeline that deploys updates multiple times per day. However, a recent security incident traced back to a misconfigured cloud resource that was provisioned by an automated script. The team wants to prevent similar issues. What is the most effective DevSecOps practice to adopt?

   • ADisable automated provisioning and require all cloud resources to be created manually by the security team.
   • BRequire a manual security review of every cloud resource after it is created.
   • CAdd infrastructure-as-code security scanning to the pipeline to catch misconfigurations before deployment.
   • DIncrease logging on all cloud resources and review logs weekly.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company has a DevOps pipeline that deploys code several times a day. The security team is overwhelmed because they only perform manual reviews after each release. The company wants to adopt DevSecOps to improve efficiency. What is the primary advantage they will gain?

   • AThe company will be able to deploy code without any security checks.
   • BAutomated security checks reduce the manual workload on the security team and provide faster feedback to developers.
   • CDevelopers will no longer need to worry about security because the pipeline handles it.
   • DThe security team will be able to eliminate all manual testing.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A startup is building a new microservices application. They want to adopt DevSecOps from the start. Which practice best exemplifies integrating security into every phase of the lifecycle?

   • AInstall a firewall and antivirus on all production servers.
   • BPerform a penetration test once the application is fully built and before launch.
   • CHire a security consultant to review the code after each major release.
   • DConduct threat modeling during design, use secure coding standards, and run automated security tests in CI/CD.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company is transitioning from DevOps to DevSecOps. The security team has historically been a 'no' gate at the end of the release process, and developers have learned to avoid them until the last moment. Management wants to change this dynamic. Which approach is most likely to succeed in changing the culture?

   • AGive the security team the authority to block any release that does not meet their standards.
   • BCreate a security scorecard that ranks developers based on the number of vulnerabilities they introduce.
   • CChange the security team's role from gatekeeper to enabler by having them provide self-service security tools and training to developers, and measure success by the number of vulnerabilities fixed early.
   • DRequire developers to attend a one-time security training session.
   Reveal Solution Discussion Select an answer first