Understanding DevSecOps DSE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company's DevOps team has been deploying code to production every two weeks. After a recent security audit, the CISO wants security checks integrated into the pipeline without slowing down the release cadence. The team currently runs security scans manually at the end of each sprint. Which approach best aligns with DevSecOps principles?

   • AMove security testing to a post-production phase to avoid impacting the release pipeline.
   • BHave developers run security tools locally and report results to the security team for manual review.
   • CKeep the current manual security review but add a dedicated security sign-off before each release.
   • DAutomate security checks as pipeline stages that run in parallel with build and test stages, with security teams consulted on policy definitions.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   In traditional DevOps, security is often:

   • AAutomated using security-as-code practices
   • BThe primary responsibility of the operations team
   • CIntegrated into every stage of the pipeline
   • DHandled as a separate phase at the end of development
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A startup wants to adopt DevSecOps to improve both speed and security. They currently have a manual security review before every release, which often causes delays. The team is small and wants to avoid adding a dedicated security team. Which benefit of DevSecOps directly addresses their need?

   • ADevSecOps requires hiring more security specialists to handle the increased workload.
   • BAutomated security checks in the pipeline reduce manual bottlenecks while maintaining security visibility.
   • CDevSecOps eliminates the need for any security testing, allowing faster releases.
   • DDevSecOps guarantees zero vulnerabilities in production if all practices are followed.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which statement best describes DevSecOps?

   • AAn approach that integrates security into every phase of the DevOps lifecycle
   • BA security framework that is applied only to production environments
   • CA set of security tools that are added to the end of the CI/CD pipeline
   • DA development methodology that focuses on faster delivery without considering security
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   In DevSecOps, the principle of 'shared responsibility' means that:

   • AThe security team is responsible for all security decisions
   • BThe operations team handles security after deployment only
   • CDevelopment, operations, and security teams all contribute to security
   • DSecurity is outsourced to a third-party vendor
   Reveal Solution Discussion Select an answer first