Shift-Left Security and DevSecOps Culture DSE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A development team is about to start a new microservices project. The security team wants to introduce security activities earlier in the SDLC. The team has limited security staff and wants to avoid slowing down development. Which approach best embodies shift-left security?

   • AProvide developers with a security checklist to review before deployment.
   • BPerform a full penetration test after each release in production.
   • CAdd security requirements to the project backlog but defer them until after the first release.
   • DConduct a threat modeling session during the design phase and integrate SAST into the CI pipeline.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A development team wants to implement shift-left security but has a legacy codebase with many existing vulnerabilities. They want to avoid overwhelming developers. What is the most effective way to apply shift-left practices?

   • AIgnore existing vulnerabilities and only focus on new features.
   • BRun SAST on new code only and create a separate backlog to address existing vulnerabilities.
   • CPerform a one-time penetration test and fix only the critical findings.
   • DRun SAST on the entire codebase and block all builds until every vulnerability is fixed.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   During a DevSecOps adoption, the operations team is resistant because they fear that new security automation will replace their manual monitoring tasks. What is the best way to address this resistance?

   • AReassure them that no changes will be made to their current processes.
   • BOffer them early retirement packages to smooth the transition.
   • CInvolve the operations team in the design and implementation of the security automation, and emphasize how it will augment their work rather than replace it.
   • DImplement the automation without consulting the operations team to avoid debate.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A DevOps team wants to implement shift-left security practices in their CI/CD pipeline. They have a diverse application stack and want to catch common vulnerabilities early without overwhelming developers. Which combination of practices is most aligned with shift-left?

   • AConduct a single threat modeling session at the end of the project.
   • BIntegrate SAST and dependency scanning into the CI pipeline and fail builds on critical findings.
   • CRun SAST on every commit and require manual security sign-off before merging.
   • DPerform DAST only on the final release candidate.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company is adopting DevSecOps, but the operations team is resistant because they have been burned in the past by security changes that caused outages. They prefer to keep the environment stable and are wary of any new automated security controls. The company needs to move forward with DevSecOps while maintaining operational stability. Which approach best addresses this resistance?

   • AImmediately implement all security controls in the pipeline, including those that can block deployments, to enforce security.
   • BStart with non-intrusive security controls, such as read-only scanning and monitoring, and gradually introduce more active controls after the operations team sees the benefits.
   • CPromise the operations team that no security controls will ever affect the production environment.
   • DExclude the operations team from security discussions to avoid conflict.
   Reveal Solution Discussion Select an answer first