DevOps vs. DevSecOps DSE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A team is proud of its DevOps culture where developers and operations collaborate closely. However, security is still a separate team that only gets involved at the end of a project. The team wants to adopt DevSecOps. What is the first step they should take?

   • ACreate a security policy document and distribute it to all developers.
   • BAsk the security team to produce a monthly report of vulnerabilities found in production.
   • CInvite a security engineer to join the team's sprint planning and daily standup meetings.
   • DPurchase a new security scanning tool and run it once at the end of each sprint.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company is adopting DevSecOps. The development team is small and has limited security expertise. The security team is also small and cannot review every code change. The company wants to improve its security posture without hiring additional staff. Which strategy best leverages DevSecOps principles to address this constraint?

   • AImplement automated security scanning in the CI/CD pipeline and create a triage process where developers are trained to fix common vulnerabilities, while the security team only reviews complex or high-risk findings.
   • BDeploy a new security tool that automatically fixes all vulnerabilities without human intervention.
   • CHave the security team manually review every pull request before it is merged.
   • DAsk developers to run security scans on their local machines and report the results at the end of each sprint.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   How does DevSecOps contribute to faster remediation of security issues?

   • ABy reducing the number of security tests to avoid delays
   • BBy deferring security testing until after deployment
   • CBy detecting vulnerabilities early in the development process
   • DBy assigning all security fixes to a separate operations team
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company is considering adopting DevSecOps. The development team is concerned that adding security tasks will slow down their delivery pipeline. The security team is concerned that they will be overwhelmed by the volume of alerts. Which benefit of DevSecOps directly addresses both concerns?

   • AThe security team will no longer need to monitor alerts because the pipeline will automatically fix all vulnerabilities.
   • BThe development team will be able to skip security testing if they are under a tight deadline.
   • CAutomated security checks in the pipeline provide fast feedback, while developers are trained to triage and fix common issues, reducing the load on the security team.
   • DThe company will hire more security staff to manually review every code change.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company is moving from a DevOps model where security is a separate team to DevSecOps. The security team is used to being the final authority on security, and developers are used to deploying quickly without consulting them. The company has experienced a security incident due to a misconfigured cloud resource. Management wants to prevent similar incidents. Which change is most important?

   • AGive the security team the authority to manually approve all cloud configuration changes.
   • BRequire developers to take a cloud security training course.
   • CCreate a post-incident review process to document what went wrong.
   • DImplement automated policy-as-code checks in the CI/CD pipeline that validate cloud configurations before deployment, and have both developers and security engineers collaborate on defining the policies.
   Reveal Solution Discussion Select an answer first