Understanding DevSecOps DSE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A development team wants to implement 'security as code' in their infrastructure. They currently manage their infrastructure using Terraform and want to ensure that security policies are enforced consistently across all environments. Which practice best aligns with this goal?

   • ADocument security policies in a wiki and manually apply them to each environment.
   • BStore security policies as Terraform configuration files and review them in the same code review process as application code.
   • CHave the security team manually configure each environment after Terraform applies the infrastructure.
   • DUse a separate, unversioned script to apply security settings after infrastructure is deployed.
   Reveal Solution Discussion Select an answer first
2. 7expert · medium

   A company has a mature DevOps pipeline with automated builds, tests, and deployments. They want to add security without slowing down the pipeline. The security team is small and cannot review every change. The developers are skilled but have limited security knowledge. Which strategy best addresses these constraints?

   • AImplement automated security scanning tools in the pipeline and provide developers with training on interpreting results.
   • BDeploy security scanning only in the production environment to avoid pipeline delays.
   • CRequire developers to complete a security certification before they can commit code.
   • DHave the security team review every code change before it is merged.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company is considering adopting DevSecOps to improve its security posture. They are concerned that adding security to the pipeline will slow down delivery. Which benefit of DevSecOps addresses this concern?

   • ADevSecOps requires more security staff, but they work in parallel with developers.
   • BAutomated security checks reduce manual review time and can be run in parallel with other pipeline stages.
   • CDevSecOps eliminates the need for security testing, speeding up delivery.
   • DDevSecOps moves all security testing to the production environment, avoiding pipeline delays.
   Reveal Solution Discussion Select an answer first
5. 9application · medium · select all that apply

   A company is adopting DevSecOps and wants to implement the principle of 'continuous security.' Which practices align with this principle? Select all that apply.

   • ARunning automated security scans on every code commit.
   • BAutomating compliance checks as part of the deployment pipeline.
   • CMonitoring production environments for security threats in real time.
   • DUpdating security policies only once a year.
   • EPerforming a security review only at the end of each release.
   Check answers Discussion Select an answer first
6. 10application · medium

   A manager says, 'DevSecOps is just DevOps with more security tools.' Which statement best corrects this misconception?

   • ADevSecOps is a cultural and technical shift that integrates security into every stage of the DevOps lifecycle, not just adds tools.
   • BDevSecOps focuses only on securing the production environment.
   • CDevSecOps is the same as DevOps but with a larger security team.
   • DDevSecOps replaces DevOps with a new methodology that does not use CI/CD.
   Reveal Solution Discussion Select an answer first