Pillars, Benefits, and Challenges of DevSecOps DSE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company wants to foster a 'security is everyone's job' culture. Currently, only the security team reviews code for vulnerabilities. Which practice best promotes the 'sharing' pillar?

   • APublish security policies on an internal wiki that only the security team can edit.
   • BRequire developers to submit security reports to the security team for approval.
   • CKeep security incidents confidential to avoid panic among teams.
   • DHold regular 'security guild' meetings where developers, operations, and security share lessons learned and best practices.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company is adopting DevSecOps and has a mix of legacy and modern applications. The legacy applications cannot easily integrate with modern security tools. The team wants to improve security across the portfolio without delaying the migration of legacy apps. Which approach best balances security improvement and migration efforts?

   • AApply automated security scanning to modern applications and implement compensating controls, such as network segmentation and monitoring, for legacy applications.
   • BFocus all security efforts on modern applications and ignore legacy applications until they are migrated.
   • CUse the same security tools for legacy applications even if they are not compatible.
   • DRequire all legacy applications to be migrated before any security improvements are made.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is a common challenge related to tooling in DevSecOps?

   • ASecurity tools being too expensive for any organization
   • BHaving too many security tools to choose from
   • CIntegrating security tools with existing CI/CD pipelines
   • DFinding tools that are too simple to use
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company is adopting DevSecOps. They have a strong automation culture but are struggling because security findings are often ignored by developers, and the security team is overwhelmed with false positives. The company wants to improve without slowing down delivery. Which approach best balances the pillars of automation, measurement, and sharing?

   • ADisable security scanning until the teams agree on a new process.
   • BIncrease the number of security tools to catch more issues, and require developers to fix every finding.
   • CTune the security tools to reduce false positives, track the rate of security findings over time, and hold regular feedback sessions between developers and security.
   • DAutomate the deployment of security patches without developer involvement.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company wants to adopt DevSecOps to improve security and delivery speed. However, their security team is small and cannot review every code change. Developers are not security experts. Which approach best leverages the benefits of DevSecOps while addressing the skill gap?

   • AImplement automated security checks that provide clear, actionable feedback to developers, and have the security team review only high-risk changes.
   • BTrain all developers to become security experts before implementing DevSecOps.
   • COutsource all security reviews to an external vendor.
   • DRequire the security team to review every code change manually.
   Reveal Solution Discussion Select an answer first