DevOps vs. DevSecOps DSE Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A company is adopting DevSecOps. The security team is currently responsible for all security decisions and is overwhelmed. The development team has expressed interest in learning more about security but lacks the skills. The company wants to improve security without increasing headcount. Which approach best aligns with DevSecOps principles?

   • AOutsource all security testing to an external vendor to reduce the internal workload.
   • BRequire all developers to become security experts before they can commit code.
   • CHave the security team continue to make all security decisions but provide them with more automation tools.
   • DCreate a security champions program where selected developers receive additional security training and act as liaisons between the security team and development teams.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which of the following is a core principle of DevOps?

   • ADeploying software only after all security tests are completed manually
   • BAutomating repetitive tasks to improve efficiency and consistency
   • CSeparating development and operations responsibilities to avoid conflicts
   • DMinimizing communication between teams to reduce distractions
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A development team has been practicing DevOps for two years. They deploy code to production multiple times daily, but security testing is only performed by a separate security team after the release is deployed. The company has experienced several production incidents caused by vulnerabilities that were introduced during development. The team wants to adopt DevSecOps practices. Which change best represents a shift from DevOps to DevSecOps?

   • AIncrease the frequency of security audits from annually to quarterly.
   • BMove security testing earlier in the pipeline so that automated security checks run on every commit, and developers are responsible for fixing findings before deployment.
   • CHave the security team create a list of vulnerabilities and email it to developers once a month.
   • DKeep the current pipeline but add a manual security review by the security team after each production deployment.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A team is building a CI/CD pipeline for a new application. They want to follow DevSecOps principles. Which set of pipeline stages best reflects this?

   • ACode commit triggers static analysis, dependency scanning, and container scanning before automated deployment to staging.
   • BCode commit triggers automated deployment to production, with security testing performed after release.
   • CCode commit triggers a manual security review by a separate team before any automated build.
   • DCode commit triggers a build, and security scanning is performed only when a new vulnerability is announced.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company has a mature DevOps culture where developers and operations collaborate closely, but security is a separate team that only gets involved at the end of each sprint. Leadership wants to transition to DevSecOps. What cultural change is most essential?

   • AKeep security as a separate team but ask them to write more detailed documentation for developers.
   • BRequire developers to pass a security certification before they can commit code.
   • CMove the security team to a different building to reduce distractions.
   • DEmbed security engineers directly into each development team and include security tasks in the shared backlog.
   Reveal Solution Discussion Select an answer first