Integrating a Continuous Feedback Loop DSE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A DevSecOps team wants to automate the rollback of a deployment if a critical security alert is triggered in production. The pipeline uses a blue/green deployment strategy. What is the best way to implement this automated feedback mechanism?

   • AHave an on-call engineer manually roll back the deployment when they see the alert
   • BConfigure the monitoring system to send a webhook to the orchestration tool when a critical alert fires, triggering an automated rollback to the previous stable version
   • CWait for the next scheduled deployment to fix the issue
   • DDisable the blue/green deployment and use a single environment to simplify rollback
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A DevSecOps team wants to track whether their feedback loop is effective in reducing security debt. Which metric would be most useful for this purpose?

   • ANumber of open critical and high-severity vulnerabilities over time
   • BNumber of security tools deployed in the pipeline
   • CNumber of lines of code in the application
   • DNumber of security team meetings per month
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A DevSecOps team is reviewing feedback from the last month. They see that 80% of the critical vulnerabilities were found in a single microservice, and most were introduced by the same developer. What should the team do first?

   • AAnalyze the root cause of why that microservice and developer produce more vulnerabilities, such as missing security training or complex code.
   • BIgnore the trend because it is only one month of data.
   • CReplace the developer with a more experienced one.
   • DRemove the microservice from the pipeline to avoid future vulnerabilities.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A DevSecOps team wants to measure the effectiveness of their continuous feedback loop. They currently track the number of security scans run per week and the number of vulnerabilities found. They want to add a metric that directly reflects whether the feedback loop is leading to improvements. Which metric should they add?

   • ANumber of security tools integrated into the pipeline.
   • BPercentage of developers who attended security training.
   • CPercentage of vulnerabilities that are remediated within the SLA.
   • DTotal number of alerts generated per day.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A DevSecOps team notices that developers are not reporting security issues they find because they fear being blamed. The team wants to encourage open communication. What is the best approach to foster a blameless feedback culture?

   • ARequire developers to report issues only to their direct manager
   • BCreate a public list of developers who introduced security issues
   • CEstablish a blameless post-mortem process that focuses on system failures and process improvements, not individual mistakes
   • DIgnore minor security issues to avoid conflict
   Reveal Solution Discussion Select an answer first