DevOps vs. DevSecOps DSE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is a key difference between DevOps and DevSecOps?

   • ADevOps is only for development teams, while DevSecOps is only for security teams
   • BDevOps does not use CI/CD pipelines, while DevSecOps does
   • CDevOps focuses on automation, while DevSecOps focuses on manual processes
   • DDevOps treats security as a separate phase at the end, while DevSecOps integrates security throughout
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A team has a well-functioning DevOps pipeline that delivers features rapidly. However, a recent audit found that several security vulnerabilities were present in production for weeks before being detected. The team wants to adopt DevSecOps. What is the most important process change to make?

   • ASchedule a monthly security review of the codebase by an external consultant.
   • BIntegrate security testing into the CI/CD pipeline so that every build is automatically scanned for known vulnerabilities.
   • CRequire developers to manually run a security scanner on their local machines before pushing code.
   • DIncrease the frequency of production security audits from quarterly to monthly.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company has a mature DevOps pipeline that deploys to production on every merge to the main branch. The security team is currently not involved until after a release is deployed. Management wants to adopt DevSecOps but is concerned that adding security checks might slow down the pipeline. The company has a compliance requirement to scan all container images for known vulnerabilities before they run in production. Which approach best balances security and delivery speed?

   • AAdd a container image scanning step to the CI pipeline that runs in parallel with existing tests and fails the build only if critical or high severity vulnerabilities are found.
   • BScan container images only in the production environment after deployment.
   • CPerform the container image scan only on the final release candidate after all tests pass.
   • DRequire a manual security review of every container image before it is deployed.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company has a DevOps pipeline that automates code integration, testing, and deployment. They want to incorporate security without creating a separate, slow security phase. Which practice best exemplifies DevSecOps?

   • ARun a comprehensive security test only on the final release candidate before deployment.
   • BHave the security team manually review the code after each deployment.
   • CAdd security scanning as a parallel stage in the pipeline that runs on every commit and provides results to developers in the same interface as other tests.
   • DCreate a separate security team that works independently and reports to the CISO.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A software company currently uses a DevOps pipeline that automates builds, tests, and deployments. The security team is not involved until after a release candidate is created. The company wants to improve its security posture without slowing down the release cadence. Which approach aligns with DevSecOps principles?

   • APerform a full penetration test on every production release after deployment.
   • BAdd automated security scanning tools to the existing CI/CD pipeline and configure them to fail the build on critical vulnerabilities.
   • CRequire the security team to manually review every commit before it is merged.
   • DCreate a separate security pipeline that runs only on a nightly schedule.
   Reveal Solution Discussion Select an answer first