Understanding DevSecOps DSE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An organization is implementing DevSecOps and wants to ensure that security is not dependent on a single individual. They want to embed security knowledge across the team. Which principle of DevSecOps should they emphasize?

   • ASecurity as code, which encodes security policies in configuration files.
   • BContinuous security, which ensures security is always active.
   • CAutomation, which replaces the need for human security expertise.
   • DShared responsibility, where every team member is accountable for security in their domain.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   An organization has adopted DevOps but security is still a separate team that performs manual penetration tests after each release. The company wants to move to DevSecOps, but the security team is concerned that automation will replace their jobs. Developers are concerned that security will slow them down. Which strategy best addresses both concerns?

   • AAutomate routine security checks in the pipeline and reassign security staff to higher-value activities like threat modeling and security architecture review.
   • BEliminate the security team and rely entirely on automated scanning tools.
   • CKeep the manual penetration tests but have developers watch the security team perform them.
   • DAsk the security team to write automated tests but continue to run manual tests after every release.
   Reveal Solution Discussion Select an answer first
4. 18application · medium · select all that apply

   A company wants to foster a DevSecOps culture. Which actions support the cultural shift toward collaboration and shared responsibility? Select all that apply.

   • ACreating a blame-free environment where teams can learn from security incidents.
   • BKeeping security decisions centralized within the security team.
   • CEncouraging developers to report security issues without fear of punishment.
   • DRewarding teams based on both feature delivery and security metrics.
   • EHaving security engineers participate in daily stand-up meetings with development teams.
   Check answers Discussion Select an answer first
5. 19application · medium

   A large enterprise is transitioning from a traditional DevOps model to DevSecOps. The security team is used to performing audits at the end of each release and has little interaction with developers. The operations team manages infrastructure manually. Which cultural change is most critical for a successful DevSecOps adoption?

   • ARequire developers to complete a security training course before they can commit code.
   • BEstablish a DevSecOps center of excellence that defines security policies and communicates them to all teams.
   • CIncrease the frequency of security audits to catch issues earlier in the release cycle.
   • DEmbed security engineers into development and operations teams to work together on a daily basis.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   In a DevSecOps culture, the security team is expected to:

   • ATake over the deployment process from operations
   • BWork in isolation and only review code at the end
   • CProvide tools and guidance to enable other teams to build secure software
   • DFocus only on compliance and auditing
   Reveal Solution Discussion Select an answer first