A company wants to foster a security-first mindset, but they have a very diverse workforce: some developers are security-savvy, while others have little security knowledge. The company has a limited training budget and cannot afford to send everyone to a security conference. Which strategy is most effective in promoting a security-first mindset across the entire team?

Require all developers to complete a paid online security certification course.

Send only the most security-savvy developers to the conference and have them share their notes via email.

Rely on the security team to provide one-on-one coaching to each developer as needed.

Create a tiered training program: basic security awareness for all, and advanced, role-specific training for those who need it, using internal experts as trainers.

An organization is moving to DevSecOps. The operations team is used to being responsible for production stability, and the security team is used to being the sole authority on security. What is the best way to align with DevSecOps culture?

Have security approve all changes to production to ensure safety.

Have operations make all security decisions because they understand production.

Establish cross-functional teams with shared goals and joint accountability for security and stability.

Keep operations and security separate to maintain clear lines of responsibility.

Which practice is an example of shift-left security?

Reviewing security logs only after a security incident occurs

Conducting a penetration test only after the application is deployed to production

Waiting until the end of the sprint to perform a security review of all code changes

Performing static application security testing (SAST) during the build stage of CI/CD

A startup is building a new web application and wants to adopt shift-left security. They have a small team and limited budget. Which approach best applies shift-left principles?

Hire a penetration testing firm to test the application after each release.

Use open-source SAST tools in the CI pipeline and train developers on secure coding.

Purchase an expensive enterprise security suite and implement it at the end of the project.

Wait until the application is feature-complete before starting any security work.

Which approach helps overcome resistance to DevSecOps adoption?

Mandating immediate, large-scale changes across all teams

Assigning all DevSecOps responsibilities to a single team

Eliminating all existing security processes to start fresh

Starting with small pilot projects that demonstrate quick security wins

EC-CouncilDevSecOps Essentials

Domain 2Objective 4

Shift-Left Security and DevSecOps Culture DSE Practice Questions (Page 9)

Part of the DevOps and DevSecOps Foundations domain, which makes up ~15% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–2 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

6concepts

Questions 41–45

41expert · hard
A company wants to foster a security-first mindset, but they have a very diverse workforce: some developers are security-savvy, while others have little security knowledge. The company has a limited training budget and cannot afford to send everyone to a security conference. Which strategy is most effective in promoting a security-first mindset across the entire team?
Select an answer first
42application · medium
An organization is moving to DevSecOps. The operations team is used to being responsible for production stability, and the security team is used to being the sole authority on security. What is the best way to align with DevSecOps culture?
Select an answer first
43foundation · easy
Which practice is an example of shift-left security?
Select an answer first
44application · medium
A startup is building a new web application and wants to adopt shift-left security. They have a small team and limited budget. Which approach best applies shift-left principles?
Select an answer first
45foundation · easy
Which approach helps overcome resistance to DevSecOps adoption?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DSE” is a trademark of its owner, used for identification only.