Integrating a Continuous Feedback Loop DSE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the purpose of defining KPIs for a continuous feedback loop?

   • ATo measure the effectiveness of the feedback loop and identify areas for improvement
   • BTo replace the need for qualitative analysis
   • CTo make the feedback loop more complex
   • DTo ensure that all feedback is positive
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A DevSecOps team wants to collect feedback from multiple stages of their software delivery process. They currently have CI pipeline logs, security scan reports, and production monitoring alerts. Which additional source would provide the most valuable feedback for improving the security of the development process?

   • AThe number of open bugs in the issue tracker.
   • BThe time it takes to build the application.
   • CThe number of commits per developer per day.
   • DIncident postmortems from past security incidents.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company has separate development, security, and operations teams. Security findings are often reported through a ticketing system, but developers say they do not understand the tickets, and operations says they are not informed about security changes until after deployment. The company wants to improve collaboration and feedback sharing. What is the most effective approach?

   • ACreate a shared feedback channel where security, development, and operations can discuss findings and decisions together.
   • BSend all security findings to the CTO and let them decide what to do.
   • CHave the security team write more detailed tickets with step-by-step instructions for developers.
   • DHave the operations team deploy security fixes directly without involving development.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which of the following is an example of a KPI for a continuous feedback loop?

   • AThe number of employees in the security team
   • BThe brand of the monitoring tool
   • CThe color of the CI/CD dashboard
   • DMean time to remediate (MTTR) a critical vulnerability
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A DevSecOps team collects feedback from multiple sources: SAST reports, dependency scans, runtime monitoring alerts, and incident postmortems. They notice that the number of open security findings is growing, but they are not sure which issues to fix first. What should they do to prioritize remediation effectively?

   • AFocus only on the findings from the most recent scan and ignore historical data.
   • BFix all findings in the order they were reported.
   • CRank findings by a risk score that combines severity, exploitability, and business impact.
   • DAssign every finding to a developer and let each developer choose what to work on.
   Reveal Solution Discussion Select an answer first