Building a DevSecOps Culture ECDE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An organization is adopting DevSecOps. The security team is small and cannot review every code change. The developers want to move faster. Which approach best balances speed and security while fostering shared responsibility?

   • AHave the security team review every code change, even if it slows down development.
   • BAllow developers to release code without any security review to maintain speed.
   • CCreate a separate security review queue that developers can submit to when they have time.
   • DProvide developers with automated security scanning tools and a clear policy for when they must escalate to the security team.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A DevSecOps team is struggling because developers, security engineers, and operations staff use different chat channels and rarely share context. Security findings are reported in a separate ticketing system that developers rarely check. Which practice best improves collaboration and communication?

   • AHave security engineers present a slide deck of findings once a month to all teams.
   • BCreate a shared team channel where security findings are posted automatically and hold a brief daily stand-up to review open items.
   • CRequire all security findings to be emailed to the team lead, who then forwards them to the relevant developer.
   • DKeep the separate ticketing system but ask developers to check it at the end of each sprint.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is a key benefit of using shared chat channels and regular cross-team stand-ups in a DevSecOps environment?

   • AThey allow security issues to be raised and resolved quickly through open communication.
   • BThey ensure that only security experts can discuss security topics.
   • CThey reduce the need for documentation and formal processes.
   • DThey replace the need for automated security testing.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which statement best describes the core principle of shared responsibility in a DevSecOps culture?

   • AThe operations team is responsible for security after deployment, while developers focus only on feature delivery.
   • BSecurity is handled by automated tools, so individual team members do not need to think about security.
   • CEach team member is accountable for security within their own domain, and security considerations are integrated into everyday work.
   • DSecurity is primarily the responsibility of the dedicated security team, who must approve all changes before deployment.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company is moving from a traditional model where the security team reviews code only at the end of each sprint. Developers complain that security tickets arrive too late and force rework. The security team is hesitant to share its scanning tools because they fear losing control. Which approach best aligns with DevSecOps culture principles?

   • AEmbed a security engineer in each development team and have developers run the same security scanners locally before committing code.
   • BHave the security team create a centralized list of vulnerabilities and email it to developers after each release.
   • CKeep the current review process but add a security sign-off gate at the end of each sprint to enforce accountability.
   • DAsk developers to self-certify that their code is secure and only escalate to the security team when a production incident occurs.
   Reveal Solution Discussion Select an answer first