A team wants to integrate security feedback into their CI/CD pipeline, but they are concerned about the performance impact on the pipeline. They have a large codebase and limited CI runners. What is the best way to integrate security scans without significantly increasing pipeline time?

Run incremental scans that only analyze the files changed in the commit.

Run scans only in the production environment after deployment.

Use a single CI runner for all scans to reduce resource usage.

Run full scans on every commit and accept the longer pipeline time.

Which action is an example of closing the loop on feedback?

Updating a security policy based on lessons learned from an incident

Ignoring feedback that seems repetitive

Archiving feedback without review

Why is a culture of open communication important for an effective continuous feedback loop?

It allows teams to hide security issues until they are fixed

It encourages teams to share findings and insights without fear of blame

It reduces the need for automated feedback tools

It ensures that only security experts provide feedback

A DevSecOps team wants to reduce the time between a security scan finding a vulnerability and the developer seeing it in their pull request. They already have SAST and dependency scanning in the CI pipeline. Which approach best closes this feedback gap?

Email a weekly summary of all scan results to the development team.

Run scans only on the main branch after merge and notify the team of issues.

Post scan results as comments directly on the pull request that triggered the pipeline.

Store scan results in a shared folder and ask developers to check it before merging.

In DevSecOps, what is the primary purpose of a continuous feedback loop?

To create a single point of contact for security incidents

To ensure that all security vulnerabilities are fixed immediately

To replace manual security reviews with automated tools

To provide ongoing information that helps teams improve security and operational processes

EC-CouncilDevSecOps Essentials

Domain 6Objective 5

Integrating a Continuous Feedback Loop DSE Practice Questions (Page 4)

Part of the DevSecOps Monitoring and Feedback domain, which makes up ~15% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–2 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

8concepts

Questions 16–20

16application · medium
A team wants to integrate security feedback into their CI/CD pipeline, but they are concerned about the performance impact on the pipeline. They have a large codebase and limited CI runners. What is the best way to integrate security scans without significantly increasing pipeline time?
Select an answer first
17foundation · easy
Which action is an example of closing the loop on feedback?
Select an answer first
18foundation · easy
Why is a culture of open communication important for an effective continuous feedback loop?
Select an answer first
19application · medium
A DevSecOps team wants to reduce the time between a security scan finding a vulnerability and the developer seeing it in their pull request. They already have SAST and dependency scanning in the CI pipeline. Which approach best closes this feedback gap?
Select an answer first
20foundation · easy
In DevSecOps, what is the primary purpose of a continuous feedback loop?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DSE” is a trademark of its owner, used for identification only.