Integrating a Continuous Feedback Loop DSE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A company has a mature DevSecOps pipeline with SAST, DAST, dependency scanning, and runtime monitoring. They collect a large amount of feedback, but the security team is overwhelmed and developers complain that they receive too many alerts, many of which are false positives. The team wants to improve the feedback loop without reducing the number of security tools. What is the most effective approach?

   • ATurn off all alerts except those from the runtime monitoring tool.
   • BHave the security team manually review every alert and forward only the critical ones to developers.
   • CImplement a centralized feedback aggregation platform that correlates findings, deduplicates alerts, and assigns risk scores.
   • DIncrease the alert thresholds in all tools to reduce the number of alerts.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A DevSecOps team is integrating security feedback into a CI/CD pipeline. They have a SAST tool that produces a report with false positives. The team wants to avoid blocking developers on false positives while still catching real vulnerabilities. They also want to ensure that critical vulnerabilities are never missed. What is the best approach?

   • AIgnore all SAST findings and rely on manual code reviews
   • BFail the pipeline on all findings regardless of severity
   • CConfigure the pipeline to fail on critical findings only, and route medium and high findings to a review queue for triage
   • DFail the pipeline only on medium and high findings, but allow critical findings to pass
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company's security team regularly finds issues in code, but developers say they only hear about problems after a release, and the security team says developers ignore their reports. Which practice would most improve the feedback culture?

   • ACreate a security dashboard and ask developers to check it weekly.
   • BHold a joint review session after each release where security and development discuss findings together.
   • CHave the security team fix the issues themselves and commit the changes.
   • DSend security findings only to the engineering manager.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A team wants to automatically create a bug ticket in their issue tracker whenever a security scan in the CI/CD pipeline finds a medium-severity vulnerability. The pipeline already has access to the issue tracker's API. What is the best way to implement this automated feedback mechanism?

   • AHave the security team manually create tickets after reviewing each scan report
   • BSend the scan report to a shared email distribution list
   • CStore the scan report in a shared drive for later review
   • DAdd a pipeline step that calls the issue tracker API to create a ticket when the scan report contains a medium-severity finding
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which of the following is an example of integrating a feedback mechanism into a CI/CD pipeline?

   • AAdding a step that runs a static application security testing (SAST) tool and fails the build if critical issues are found
   • BSending an email to the security team after every deployment
   • CConducting a manual code review after the release
   • DCreating a spreadsheet of vulnerabilities found in production
   Reveal Solution Discussion Select an answer first