Building a DevSecOps Culture ECDE Practice Questions (Page 10)

Questions 46–49

1. 46expert · hard

   A DevSecOps team wants to measure the effectiveness of their security feedback loop. They currently track the number of vulnerabilities found in production and the time to fix them. Which additional metric would provide the most insight into whether the feedback loop is improving?

   • ANumber of security meetings held per month.
   • BTotal number of security tools used in the pipeline.
   • CPercentage of vulnerabilities detected during development versus in production.
   • DAverage severity of vulnerabilities found in production.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   Which strategy is most effective for gaining leadership buy-in for a DevSecOps cultural transformation?

   • AMandating that all teams adopt DevSecOps practices immediately without explaining benefits.
   • BWaiting for a security breach to justify the need for change.
   • CDemonstrating how DevSecOps reduces risk and accelerates delivery with measurable outcomes.
   • DFocusing only on tooling and automation, assuming culture will follow automatically.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A company's leadership wants to adopt DevSecOps but is unsure how to start. They ask you for a first step that embodies the principle of continuous improvement. Which recommendation is most aligned?

   • APurchase a comprehensive security suite and deploy it across all projects at once.
   • BHire a DevSecOps consultant to run the entire transformation without involving internal teams.
   • CRun a retrospective after each release to discuss what went well and what security issues were found, then implement one improvement.
   • DWrite a detailed DevSecOps policy document and distribute it to all employees.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A development team is adopting DevSecOps. The security team currently owns all vulnerability management. Developers believe they only need to write features and that security is someone else's job. Which change best instills security as a shared responsibility?

   • AAdd a security review phase at the end of the release cycle where the security team approves or rejects the release.
   • BKeep the security team as the sole owner of vulnerabilities and have them fix all issues directly.
   • CHave developers triage and fix vulnerabilities found in their own code, with security engineers providing guidance and reviewing the fixes.
   • DAutomate vulnerability scanning and send the report only to the security team for action.
   Reveal Solution Discussion Select an answer first