Understanding DevSecOps DSE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A DevOps team is designing a new CI/CD pipeline. They want to ensure that security is not a separate phase but is integrated throughout. Which combination of practices best reflects the core principles of DevSecOps?

   • AA dedicated security phase before release, with security teams approving every change.
   • BManual security testing after deployment, with security teams responsible for all findings.
   • CAutomated security scanning in every stage, with security teams defining policies and developers implementing fixes.
   • DAutomated security scanning only in the production environment.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the core purpose of DevSecOps?

   • ATo integrate security practices throughout the entire DevOps lifecycle
   • BTo replace the operations team with automated security tools
   • CTo create a separate security team that works independently from development and operations
   • DTo ensure that security testing is performed only at the end of the development cycle
   Reveal Solution Discussion Select an answer first
4. 13application · medium · select all that apply

   A company is comparing DevOps and DevSecOps. Which statements correctly describe the differences between the two? Select all that apply.

   • ADevSecOps focuses only on security testing, while DevOps focuses only on delivery speed.
   • BDevSecOps adds security as an integral part of the CI/CD pipeline, whereas DevOps often treats security as a separate phase.
   • CDevSecOps includes continuous security monitoring, which is not typically a core component of traditional DevOps.
   • DDevSecOps requires a cultural shift toward shared responsibility for security among all team members.
   • EDevOps does not use automation, while DevSecOps relies heavily on automation.
   Check answers Discussion Select an answer first
5. 14application · medium

   A financial services company wants to adopt DevSecOps to reduce the risk of security incidents while maintaining a competitive release schedule. They currently perform security testing only during a dedicated phase before release. Which benefit of DevSecOps is most relevant to their goal?

   • ADevSecOps shifts security testing to the production environment to catch real-world attacks.
   • BDevSecOps eliminates all security risks, allowing faster releases without concern.
   • CAutomated security testing throughout the pipeline reduces the likelihood of vulnerabilities reaching production.
   • DDevSecOps requires fewer security controls because automation replaces human oversight.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is an example of a DevSecOps practice?

   • APerforming a security review only after the software is deployed
   • BManual penetration testing after every release
   • CDisabling security monitoring to improve performance
   • DUsing infrastructure as code to define security policies
   Reveal Solution Discussion Select an answer first