Shift-Left Security and DevSecOps Culture DSE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company is comparing two approaches: fixing vulnerabilities during development versus after deployment. They want to justify the investment in shift-left security to management. Which benefit should they highlight as the most directly tied to shift-left?

   • ALower cost of remediation because defects are found when they are cheaper to fix.
   • BReduction in the need for developer security training.
   • CGuaranteed compliance with all regulatory standards.
   • DElimination of all security vulnerabilities in the final product.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A startup is developing a mobile app and wants to ensure that security is considered from the very beginning of the project. They have a small team and limited budget. Which approach best exemplifies shift-left security?

   • AHire a penetration testing firm to test the app after each major feature is completed.
   • BPerform a security risk assessment and create security requirements during the planning phase, then use those requirements to guide development.
   • CWait until the app is released and then monitor for security issues in production.
   • DConduct a thorough security audit after the app is fully developed but before release.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   How can an organization encourage a security-first mindset among operations and security teams?

   • AEncouraging cross-team collaboration through shared goals and metrics
   • BKeeping security policies confidential to avoid overwhelming teams
   • CLimiting communication between teams to reduce distractions
   • DFocusing only on compliance checklists rather than actual security practices
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which statement best describes shift-left security?

   • AA method that moves security testing to the end of the release pipeline
   • BA process that replaces all manual security reviews with automated tools
   • CA practice that limits security responsibilities to the security team
   • DA strategy that integrates security practices into the early stages of the software development lifecycle
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company is adopting DevSecOps, but the development team resists because they see security as an extra burden. The security team is also resistant because they are used to being the gatekeepers. What is the most effective way to overcome this dual resistance?

   • AForce both teams to adopt DevSecOps through a mandatory training program.
   • BGive developers the authority to bypass security checks if they are confident in their code.
   • CGive the security team the authority to block any release that does not meet security standards.
   • DStart with a small pilot project where developers and security work together to integrate security into the CI pipeline.
   Reveal Solution Discussion Select an answer first