Understanding DevSecOps DSE Practice Questions (Page 10)

Questions 46–49

1. 46application · medium

   A development team and a security team have historically worked in silos. The developers deploy code quickly, while security performs audits only at the end of each sprint. Management wants to adopt DevSecOps. Which cultural change is most essential to achieve this goal?

   • ACreate cross-functional teams where developers, operations, and security engineers work together and share accountability for security outcomes.
   • BHave the security team approve every code change before it is committed to the repository.
   • CRequire developers to complete a security training course before they can use the CI/CD pipeline.
   • DReplace the security team with automated security tools so that no human security review is needed.
   Reveal Solution Discussion Select an answer first
2. 47expert · medium

   A large enterprise is transitioning to DevSecOps. The security team is accustomed to being the sole authority on security decisions. Developers are used to deploying code without consulting security. Operations is resistant to change. The CISO wants to implement DevSecOps without causing major disruption. Which approach best balances the need for cultural change with the existing organizational dynamics?

   • AMandate that all teams adopt DevSecOps immediately and enforce it through strict compliance audits.
   • BStart with a pilot team that includes security, development, and operations, and use their success to drive broader adoption.
   • CHave the security team create detailed policies and require all teams to follow them without exception.
   • DKeep the current structure but add security tools to the CI/CD pipeline without changing team dynamics.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A mid-sized company is moving from a traditional waterfall model to a DevOps model. The security team is concerned that security will be neglected. The management wants to adopt a model that integrates security into every phase of the software development lifecycle. Which approach best fulfills this requirement?

   • AOutsource all security testing to an external vendor on a quarterly basis.
   • BAdopt DevSecOps, which embeds security practices into the CI/CD pipeline and development workflow.
   • CContinue using the waterfall model but add a security review phase before deployment.
   • DUse DevOps and rely on the operations team to handle security after deployment.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A company is adopting DevSecOps, but the security team is used to performing manual reviews at the end of each release. Developers are frustrated because security findings are discovered late. Which cultural change would most effectively address this frustration?

   • AMove the manual security review to the beginning of the release cycle.
   • BAsk developers to run security scans only when they have extra time.
   • CHave security engineers work directly with development teams and provide guidance during the design and coding phases.
   • DCreate a new security approval step before each deployment.
   Reveal Solution Discussion Select an answer first