Understanding DevSecOps DSE Practice Questions (Page 9)

Questions 41–45

1. 41expert · medium

   A company is adopting DevSecOps. The security team is used to being the final gatekeeper for all releases. The development team wants to deploy faster. The operations team is concerned about stability. The management wants to reduce friction between teams. Which approach best aligns with DevSecOps culture while addressing all teams' concerns?

   • AEstablish a shared security policy that is automated in the pipeline, with all teams contributing to its definition.
   • BLet the security team maintain final approval authority over all releases.
   • CHave the operations team manually verify security before each deployment.
   • DAllow developers to deploy without any security checks to speed up releases.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A company currently uses DevOps with a separate security team that performs audits after each release. They want to transition to DevSecOps. Which change is most indicative of the shift?

   • AThe security team creates a checklist that developers must complete before deployment.
   • BThe security team is given read-only access to the CI/CD pipeline to monitor builds.
   • CSecurity engineers join development teams and participate in daily stand-ups and planning.
   • DThe security team continues to audit after release but uses automated tools to speed up the process.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A company's DevOps pipeline currently builds, tests, and deploys code automatically, but security reviews are performed manually by a separate security team after deployment. The company wants to reduce the time between code commit and production while ensuring vulnerabilities are caught earlier. Which change best aligns with DevSecOps principles?

   • AAdd automated security scanning tools into the existing CI/CD pipeline stages and have security teams define policies as code.
   • BIncrease the frequency of manual penetration tests from quarterly to monthly.
   • CKeep the manual security review but move it to just before the production deployment step.
   • DReplace the DevOps pipeline with a dedicated security testing platform that runs after every release.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   What is a primary benefit of adopting DevSecOps?

   • AIt eliminates the need for security testing
   • BIt guarantees that no security breach will ever occur
   • CIt reduces the risk of security vulnerabilities reaching production
   • DIt slows down the delivery process to ensure security
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A company has a mature DevOps pipeline with automated testing and deployment. They want to adopt DevSecOps but are unsure what to change. The security team currently has no visibility into the pipeline and only sees the final release. Which change is most critical to differentiate their DevOps pipeline as DevSecOps?

   • AUse a different CI/CD tool that has built-in security features.
   • BCreate a separate security pipeline that runs after the main pipeline completes.
   • CAdd a security review meeting after each release to discuss any incidents.
   • DGive the security team access to the pipeline and involve them in defining security requirements and acceptance criteria.
   Reveal Solution Discussion Select an answer first