Shift-Left Security and DevSecOps Culture DSE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security team is resistant to DevSecOps because they believe automation will replace their jobs. What is the best way to address this concern?

   • AReassure them that automation will never be used in security.
   • BTell them that their jobs will be eliminated if they do not accept DevSecOps.
   • CShow how automation handles routine checks, allowing the security team to focus on complex threats and policy.
   • DIgnore their concerns and implement automation anyway.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A DevOps team is building a CI/CD pipeline for a new web application. They want to identify common security issues such as SQL injection and cross-site scripting before the code is deployed. Which practice should they incorporate into the pipeline to achieve this?

   • APerform a manual code review only after the code is deployed to production.
   • BUse a network firewall to block malicious traffic to the application.
   • CRun a dynamic application security testing (DAST) tool only in the production environment.
   • DRun a static application security testing (SAST) tool on the source code as part of the build stage.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company is adopting DevSecOps and wants to ensure that security is a shared responsibility across development, operations, and security teams. Currently, only the security team is held accountable for vulnerabilities. Which change best supports the principle of shared responsibility?

   • ACreate a separate security audit team that reports directly to the CEO.
   • BInclude security-related tasks and metrics in the job descriptions and performance reviews of developers and operations staff.
   • CHave developers sign a waiver acknowledging that security is not their responsibility.
   • DKeep security accountability solely with the security team to maintain clear ownership.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is a common cultural barrier to adopting DevSecOps?

   • AExcessive use of automated security testing tools
   • BHaving a dedicated security team that works closely with development
   • CSiloed teams that do not communicate or share responsibility
   • DToo many security training sessions for developers
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which strategy is effective for promoting a security-first mindset among development teams?

   • ARewarding developers solely for feature delivery, ignoring security
   • BRestricting developers from accessing any security tools
   • CAssigning all security tasks to a separate security team
   • DProviding regular security training and hands-on workshops for developers
   Reveal Solution Discussion Select an answer first