Shift-Left Security and DevSecOps Culture DSE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A team is designing a new payment processing service. They want to identify potential security threats and design mitigations before any code is written. Which shift-left practice should they use?

   • APerform a penetration test on the production environment after deployment.
   • BRun a SAST scan on the codebase after the first release.
   • CConduct a threat modeling session with the development, security, and operations teams.
   • DDeploy a web application firewall to protect the service.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   An organization is adopting DevSecOps, but the security team is resistant because they fear that automating security checks will make their expertise less valued. Which approach best addresses this concern?

   • AReframe the security team's role as focusing on higher-level activities such as threat modeling, policy design, and interpreting automated findings.
   • BReduce the security team's responsibilities to only approving automated alerts.
   • CReplace the security team with a fully automated security platform.
   • DReassure them that automation will never be used and that all security checks will remain manual.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A DevOps team wants to implement shift-left security but is concerned about slowing down the CI pipeline. They have a mix of fast-changing microservices and stable legacy services. Which strategy best balances security and pipeline performance?

   • ARun full SAST on all services in parallel, but allow non-critical findings to be non-blocking.
   • BRun SAST manually on a weekly basis to avoid slowing down the pipeline.
   • CRun SAST only on the legacy services because they are more vulnerable.
   • DRun SAST only on the microservices because they are newer.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A large enterprise is adopting shift-left security but faces a constraint: the security team is understaffed and cannot review every code change. The development teams are distributed across time zones. Which approach best balances shift-left principles with the staffing constraint?

   • ADefer all security testing to a quarterly penetration test.
   • BRequire manual security review for every code change before merging.
   • CHire more security staff before implementing any shift-left practices.
   • DImplement automated SAST and dependency scanning in CI, with security review only for high-risk changes.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   What is a core cultural principle of DevSecOps?

   • ASecurity is handled exclusively by a dedicated security team
   • BDevelopers are not expected to consider security during coding
   • COperations team is solely responsible for security in production
   • DShared responsibility for security across development, operations, and security teams
   Reveal Solution Discussion Select an answer first