Building a DevSecOps Culture ECDE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A DevSecOps team is trying to improve its culture. They currently track the number of security vulnerabilities found in production. This metric has not changed in months, and the team is frustrated. Which change to their metrics would most likely drive improvement?

   • ATrack the number of security meetings held each month.
   • BTrack the number of security tools used in the CI pipeline.
   • CTrack the number of security incidents reported by customers.
   • DTrack the time from vulnerability discovery to remediation, and review the trend in retrospectives.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary purpose of feedback loops in a DevSecOps culture?

   • ATo automate all security testing without human intervention.
   • BTo document all decisions for compliance audits.
   • CTo replace the need for retrospectives and post-mortems.
   • DTo provide real-time information that helps teams adjust processes and improve outcomes.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A DevSecOps team wants to create a feedback loop that helps developers learn from security incidents without creating a blame culture. Which practice is most effective?

   • APublish a list of developers who caused security incidents.
   • BConduct a blameless post-incident review that focuses on system and process improvements.
   • CRequire developers to write a personal apology email to the CISO after an incident.
   • DTrack the number of incidents caused by each developer and use it in performance reviews.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A DevSecOps team is debating how to handle security findings in a legacy application that is scheduled for replacement in six months. The team has limited capacity and wants to balance security improvements with feature development. Which approach best aligns with DevSecOps principles?

   • AIncrease the frequency of security scans to catch more issues.
   • BPrioritize fixing only critical and high-severity vulnerabilities that are actively exploitable, and document the rest as accepted risk.
   • CDefer all security fixes until the replacement application is deployed.
   • DFix all vulnerabilities immediately, regardless of severity, to ensure the application is fully secure.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company is adopting DevSecOps. The security team is small and cannot review all code. Developers are measured on feature delivery speed, and security is not part of their performance review. The company wants to increase developer accountability for security without slowing down delivery. Which combination of actions is most effective?

   • ARequire a manual security review for every code change and add a security gate at the end of the sprint.
   • BGive developers a bonus for finding security issues in other teams' code.
   • CAdd security-related key performance indicators (KPIs) to developer performance reviews and provide automated security feedback in the CI pipeline.
   • DHire more security engineers to review all code changes and keep developer metrics unchanged.
   Reveal Solution Discussion Select an answer first