Understanding DevSecOps DSE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An organization is considering adopting DevSecOps. They currently release software every two months and have experienced several security incidents in production. They want to improve both delivery speed and security posture. Which benefit is most directly achieved by integrating security into the CI/CD pipeline?

   • AReducing the time to detect and remediate vulnerabilities by automating security checks early in the lifecycle.
   • BIncreasing the frequency of manual security audits to match each release.
   • CGuaranteeing that no vulnerabilities will ever reach production.
   • DEliminating the need for any manual security testing.
   Reveal Solution Discussion Select an answer first
2. 2expert · medium

   A company wants to implement automated security testing in its CI/CD pipeline. They have a mix of legacy and modern applications. The security team wants to enforce a policy that all code must pass security scans before deployment. However, the legacy applications have many existing vulnerabilities that would fail the scans, blocking all releases. Which approach best balances security and delivery?

   • ARequire all applications to pass the same security scans immediately, even if it blocks releases.
   • BExclude legacy applications from security scans to avoid blocking releases.
   • CRun security scans only on modern applications and manually review legacy applications.
   • DRun security scans on all code, but allow legacy applications to have a grace period with a documented remediation plan.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company has a DevOps pipeline that automates build, test, and deployment. They want to transition to DevSecOps. Which addition best represents the key difference between DevOps and DevSecOps?

   • AUsing a faster CI server to reduce build times.
   • BHiring more operations engineers to monitor the pipeline.
   • CIncreasing the number of environments from three to five.
   • DAdding automated security scanning and compliance checks as gates in the existing pipeline.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A software company wants to ensure that security vulnerabilities are identified early in the development process without slowing down developers. They have a mature CI/CD pipeline and want to adopt a DevSecOps practice that provides immediate feedback on code changes. Which practice should they implement?

   • ASchedule a weekly manual code review focused on security issues.
   • BDeploy a web application firewall in front of the production environment.
   • CIntegrate static application security testing (SAST) into the CI pipeline so that every commit triggers a scan.
   • DRun a full penetration test on the production environment after every release.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company wants to adopt 'security as code' as part of its DevSecOps practices. They currently manage security policies manually in a separate document. Which change best exemplifies security as code?

   • AStore security policies in a shared drive and update them monthly.
   • BDefine security policies as code in version control and automatically apply them during deployment.
   • CCreate a security policy document and require all teams to read it before each release.
   • DUse a configuration management tool to manually update security settings on each server.
   Reveal Solution Discussion Select an answer first