Understanding DevSecOps DSE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A software company is planning to implement DevSecOps. The management wants to ensure that security is considered from the initial design phase through deployment and operations. Which approach best embodies the core purpose of DevSecOps?

   • AHire a penetration testing firm to test the application once a year.
   • BUse a firewall and antivirus on production servers to protect the deployed application.
   • CIncorporate security requirements into user stories and use automated security checks in every pipeline stage.
   • DAdd a security review at the end of each sprint, before the release is approved.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A company has been using DevOps for several years. They now want to adopt DevSecOps. The security team currently works separately and is only involved during incident response. What is the most significant difference they need to address?

   • ADevSecOps focuses only on application security, while DevOps focuses on infrastructure security.
   • BDevSecOps eliminates the need for an operations team.
   • CSecurity must be integrated into the daily work of development and operations teams, not just incident response.
   • DDevSecOps requires replacing all existing DevOps tools with security-specific tools.
   Reveal Solution Discussion Select an answer first
4. 38application · medium · select all that apply

   A development team wants to implement automated security testing in their CI/CD pipeline. Which practices are examples of automated security testing? Select all that apply.

   • AStatic application security testing (SAST) that scans source code for known vulnerability patterns.
   • BManual penetration testing performed by an external consultant.
   • CInteractive application security testing (IAST) that combines static and dynamic analysis.
   • DSoftware composition analysis (SCA) that scans third-party dependencies for known vulnerabilities.
   • EDynamic application security testing (DAST) that tests a running application for vulnerabilities.
   Check answers Discussion Select an answer first
5. 39foundation · easy

   What is the purpose of continuous monitoring in DevSecOps?

   • ATo ensure that all code changes are manually reviewed
   • BTo detect and respond to security threats in real time
   • CTo limit access to production environments
   • DTo replace the need for automated security testing
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   An organization wants to reduce the risk of security incidents while maintaining a rapid release cadence. They are considering adopting DevSecOps. Which outcome is a realistic benefit of this adoption?

   • ASecurity incidents will be completely eliminated because all vulnerabilities are caught before production.
   • BThe security team will no longer be needed because automation handles all security tasks.
   • CThe release cadence will slow down because security checks add time to every stage.
   • DVulnerabilities will be detected earlier in the lifecycle, reducing the cost and impact of remediation.
   Reveal Solution Discussion Select an answer first