Shift-Left Security and DevSecOps Culture DSE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   How does shift-left security contribute to faster remediation of vulnerabilities?

   • ABy postponing security testing until after the release, when more time is available
   • BBy using only manual penetration testing, which provides immediate results
   • CBy identifying vulnerabilities while the code is still being developed, when the developer has the most context
   • DBy assigning all security findings to a dedicated security team for resolution
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A team is debating whether to implement shift-left security. They are concerned about the upfront effort. Which outcome best demonstrates the long-term benefit of shift-left?

   • AThe development team no longer needs to perform any manual testing.
   • BThe security team can be eliminated because developers handle everything.
   • CFewer critical vulnerabilities reach production because they are caught during development.
   • DAll vulnerabilities are fixed within minutes of being introduced.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A company is adopting DevSecOps, but the development team resists because they feel security checks slow down their delivery pipeline. The security team is also hesitant, fearing that automating security checks will reduce their control. Which approach best overcomes this cultural resistance?

   • AMandate that all security checks must pass before any code is merged, regardless of the time it takes.
   • BInvolve both teams in designing the security automation, and start with fast, non-blocking checks that provide feedback without stopping the pipeline.
   • CRemove all security checks from the pipeline and rely on post-release audits.
   • DHave the security team manually review every change before deployment to maintain control.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A company is adopting DevSecOps, but the development team is rewarded for shipping features quickly, while the security team is rewarded for finding vulnerabilities. This has created a conflict where developers hide security issues to meet deadlines, and security teams are seen as blockers. The company wants to align incentives to foster collaboration. Which approach best addresses this cultural challenge?

   • AKeep the current reward system but add a bonus for developers who report security issues.
   • BMove the security team under the development manager to ensure they prioritize speed.
   • CCreate a separate security team that is not part of the development process and only reports to the board.
   • DRedesign the reward system to include shared security metrics, such as the number of vulnerabilities detected early in the pipeline and the time to remediate them, for both teams.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   An organization wants to foster a security-first mindset but has a culture that punishes mistakes. Developers hide security issues to avoid blame. Which approach is most likely to change this culture?

   • AImplement a blameless post-incident review process and encourage open reporting of security issues.
   • BRequire developers to fix security issues silently without discussion.
   • CCreate a separate team to find and report security issues without developer involvement.
   • DIncrease penalties for developers who introduce security vulnerabilities.
   Reveal Solution Discussion Select an answer first