Pillars, Benefits, and Challenges of DevSecOps DSE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A software company wants to reduce the time it takes to fix security vulnerabilities in its web application. Currently, vulnerabilities are found during a penetration test just before release, and fixes often take weeks. Which DevSecOps practice would most directly improve this situation?

   • AIntegrate static application security testing (SAST) into the CI pipeline so developers see findings immediately after each commit.
   • BDelay releases until all known vulnerabilities are fixed, regardless of severity.
   • CHire more security testers to manually review code before each release.
   • DIncrease the frequency of penetration tests to once a month instead of once per release.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A company is implementing DevSecOps and faces resistance from the operations team, who are concerned about the reliability of automated security tools. They have seen false positives cause deployment failures in the past. Which approach best addresses this concern while maintaining the benefits of DevSecOps?

   • ARemove automated security checks and rely on manual reviews to avoid false positives.
   • BLet the operations team decide which security checks to run.
   • CImplement a 'fail-soft' mode for security checks, where failures are logged but do not block deployment, and review the logs regularly to tune the tools.
   • DMake security checks 'fail-hard' and block all deployments on any security finding.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A startup is building a new product and wants to adopt DevSecOps from the beginning. They have a small team of developers and no dedicated security staff. They want to ensure security is considered throughout development without slowing down their rapid release cycle. Which approach best aligns with DevSecOps principles?

   • AUse only manual security testing by developers before each release
   • BHire a security consultant to review code after each release
   • CDelay security implementation until the product is mature
   • DIntegrate automated security checks into the CI/CD pipeline and train developers on security basics
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A company has implemented automated security scanning in their CI/CD pipeline. However, developers often bypass the security checks by using the 'skip' option, and the security team is unaware until after production incidents. The company wants to ensure security checks are not bypassed while maintaining developer trust. Which approach best addresses this challenge?

   • ARemove the skip option entirely and block any deployment that fails security checks.
   • BMake security checks a mandatory gate that cannot be skipped, and provide a clear exception process with accountability.
   • CAllow developers to skip checks but log the skips and review them after release.
   • DIncrease the severity of penalties for developers who skip security checks.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A mid-sized company is adopting DevSecOps. They have many legacy applications and a small security team. Developers are unfamiliar with security tools. Which combination of actions best addresses the skill gap and tool integration challenges?

   • AAsk the security team to manually review all code changes until developers learn security.
   • BProvide security training to developers and start with a small set of tools that integrate with the existing CI system.
   • CPurchase an enterprise security platform and require all teams to use it immediately.
   • DOutsource all security testing to an external vendor and remove security responsibilities from internal teams.
   Reveal Solution Discussion Select an answer first