Shift-Left Security and DevSecOps Culture DSE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the core principle of shift-left security?

   • AFocusing security efforts exclusively on the operations phase
   • BPerforming security activities as early as possible in the software development lifecycle
   • CUsing only automated security tools and eliminating manual reviews
   • DDeferring all security testing until after deployment to production
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An organization wants to foster a security-first mindset among its development, operations, and security teams. Currently, security is seen as an afterthought, and developers rarely consider security implications when writing code. Which strategy is most effective in promoting a security-first mindset?

   • AProvide regular, role-specific security training and include security metrics in performance reviews.
   • BPurchase a comprehensive security scanning tool and rely on it to catch all issues.
   • CCreate a security policy document and require all employees to sign it annually.
   • DMandate that all code be reviewed by a central security team before merging.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which of the following is a common shift-left security practice?

   • APerforming a full security audit only at the end of the project
   • BConducting a post-incident review after a security breach
   • CThreat modeling during the design phase of the application
   • DMonitoring production traffic for anomalies after release
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which behavior reflects the DevSecOps cultural principle of continuous learning?

   • AAvoiding discussions about security failures to prevent blame
   • BKeeping security knowledge confined to the security team
   • CConducting regular retrospectives to discuss security incidents and near-misses
   • DUsing the same security practices without reviewing their effectiveness
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A DevOps team is used to deploying code quickly, but they often skip security checks because they are not part of the automated pipeline. The security team is not involved until after a breach occurs. Which action would most effectively promote a security-first mindset?

   • AHire a security consultant to conduct a one-time audit of the codebase.
   • BIntegrate automated security scanning into the CI/CD pipeline so that security checks are a natural part of the deployment process.
   • CDisable the deployment pipeline until the security team manually approves every release.
   • DSend a company-wide email reminding employees to consider security.
   Reveal Solution Discussion Select an answer first