Building a DevSecOps Culture ECDE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A DevSecOps team notices that security findings from the CI/CD pipeline are often ignored by developers because they are reported in a separate security tool that developers rarely open. The team wants to embed security feedback into the existing developer workflow. Which approach best aligns with DevSecOps culture principles?

   • AHave the security team manually review every pull request and email the developer with issues.
   • BRequire developers to log into the security tool every morning to check for new findings.
   • CSend a weekly email summary of all security findings to the development team lead.
   • DAdd security scanning results as comments on the pull requests that introduced the code.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security team is resistant to DevSecOps because they believe that shifting security left will eliminate their jobs. Developers also resist because they think security will slow down their delivery. Which approach best addresses both groups' resistance?

   • AOffer a bonus to any developer who finds a security vulnerability.
   • BGive the security team final approval authority over all releases.
   • CReduce the security team's responsibilities and assign all security tasks to developers.
   • DRedefine the security team's role as enabling and coaching developers, and show how automation reduces repetitive work.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which statement best illustrates the concept of shared responsibility in a DevSecOps team?

   • AOperations is responsible for runtime security, while developers are responsible for code security.
   • BThe security team defines all security requirements and other teams follow them without question.
   • CSecurity is handled by automated tools, so team members do not need to think about it.
   • DEvery team member understands security risks and contributes to mitigating them in their daily work.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An organization wants to adopt DevSecOps, but operations staff resist because they fear that new automation will eliminate their jobs. Management has approved a budget for training and tooling. Which strategy most effectively reduces this resistance?

   • AAnnounce that automation will handle routine tasks and offer retraining for higher-value roles such as incident response and reliability engineering.
   • BCreate a new security team to manage the automation and leave operations staff in their current roles.
   • CImplement the automation quietly and only inform staff after it is fully deployed to avoid early pushback.
   • DOffer a one-time bonus to staff who agree to support the new automation without changing their daily responsibilities.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A large enterprise is trying to adopt DevSecOps. The development teams are on board, but the operations team is resistant because they have historically been blamed for production issues. The security team is also resistant because they fear losing authority. Which strategy best addresses both groups' resistance?

   • ATransfer the operations team to a new reporting line and give the security team veto power over all security decisions.
   • BImplement a blameless post-incident review process and create a cross-functional security council that includes operations and security leadership.
   • CMandate that all teams use the same incident management tool and follow a standard process.
   • DOffer financial incentives to operations and security teams for adopting DevSecOps practices.
   Reveal Solution Discussion Select an answer first