Building a DevSecOps Culture ECDE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which metric is most useful for reinforcing a DevSecOps culture of continuous improvement?

   • ANumber of security meetings held per month.
   • BTotal lines of code written per sprint.
   • CMean time to remediate (MTTR) security vulnerabilities.
   • DNumber of security tools deployed in the pipeline.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A DevSecOps team is having trouble because developers and operations use different terminology for the same issues, leading to misunderstandings. Which practice would best improve communication?

   • AHave each team maintain its own documentation with its own terminology.
   • BCreate a shared glossary of security and operational terms and require it to be used in all documentation and chat.
   • CAsk developers to learn all operations terminology and adapt to them.
   • DAvoid discussing issues in detail and rely on automated alerts to communicate.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company is adopting DevSecOps and wants to ensure that security requirements are understood by all teams. Which communication practice best supports this?

   • ACreate a security portal where teams can read about requirements on their own time.
   • BPublish security requirements in a document and email it to all employees.
   • CEmbed a security engineer in each development team to provide real-time guidance.
   • DHold a one-time security awareness seminar for all staff.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which practice best exemplifies the DevSecOps principle of continuous improvement?

   • AHolding a retrospective after each iteration to identify security and process improvements.
   • BHaving the security team define all policies and procedures without input from other teams.
   • CFreezing the security toolchain to ensure stability and avoid changes.
   • DConducting a security review only after a major incident occurs.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which practice most directly fosters collaboration between development, security, and operations teams?

   • AHaving security teams review code only at the end of each release cycle.
   • BKeeping security policies confidential to avoid slowing down developers.
   • CUsing separate communication channels for each team to avoid distractions.
   • DEmbedding security specialists within cross-functional product teams.
   Reveal Solution Discussion Select an answer first