Shift-Left Security and DevSecOps Culture DSE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A development team is new to DevSecOps. They are used to focusing on features and rarely think about security. The team lead wants to encourage a security-first mindset without slowing down development. Which approach is most effective?

   • AWait for the team to encounter a security incident to motivate them.
   • BHave the security team review every line of code before it is committed.
   • CIntroduce security champions within the team who can provide peer guidance and promote security best practices in daily work.
   • DRequire developers to complete a security certification before they can write any code.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   During a DevSecOps adoption, the security team resists because they fear losing control. Developers resist because they think security will slow them down. What is the best way to overcome this cultural resistance?

   • ACreate a joint security champions program where developers and security collaborate on secure coding practices.
   • BEliminate the security team and rely on automated tools only.
   • CMandate that all security decisions must be approved by the security team.
   • DGive developers full autonomy to decide security policies.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An organization is adopting DevSecOps. The security team currently works in isolation and only reviews code at the end of each sprint. Developers feel security is a blocker. Which cultural change best aligns with DevSecOps principles?

   • AAutomate all security decisions so no human collaboration is needed.
   • BEmbed security engineers within development teams and share responsibility for security outcomes.
   • CKeep security as a separate gate at the end of the sprint to ensure independence.
   • DHave developers self-approve their own security reviews without security team involvement.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company wants to promote a security-first mindset. They have a culture where developers are rewarded for shipping features quickly, and security is an afterthought. Which initiative would most effectively shift the culture?

   • AAdd more security tools to the CI pipeline without changing team incentives.
   • BInclude security metrics in performance reviews and celebrate teams that fix vulnerabilities early.
   • CSend a company-wide email about the importance of security.
   • DRequire developers to attend a one-time security awareness seminar.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company is trying to build a DevSecOps culture. They have implemented automated security tools, but the teams still do not collaborate effectively. The security team writes policies that developers find unrealistic, and developers often bypass security controls to meet deadlines. What is the missing cultural element?

   • AReplacing the security team with automated tools to eliminate human conflict.
   • BContinuous learning and feedback loops between teams to refine policies and practices collaboratively.
   • CIncreasing the number of security audits to catch non-compliance.
   • DMore aggressive enforcement of security policies by management.
   Reveal Solution Discussion Select an answer first