Building a DevSecOps Culture ECDE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company is adopting DevSecOps and wants to ensure that security is considered in every stage of the software development lifecycle. However, the security team is small and cannot participate in every team's daily standups. Which approach best achieves security integration without overburdening the security team?

   • AHave the security team review code only at the end of each sprint.
   • BCreate a security champions program where selected developers from each team receive extra security training and act as liaisons.
   • CProvide security training to all developers and then rely on them to self-identify security issues.
   • DRequire the security team to attend every team's daily standup.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A DevSecOps team is reviewing their incident response process. They notice that security incidents are often discovered by customers rather than by internal monitoring. Which cultural change would most directly address this problem?

   • AIncrease the number of security tools in the pipeline.
   • BRequire customers to report incidents through a formal process.
   • CEncourage a culture where any team member can raise a security concern without fear of blame.
   • DHold a monthly meeting to review customer complaints.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company is trying to adopt DevSecOps, but the development team is resistant because they have a history of being blamed for security incidents. The security team is also resistant because they feel their authority is being undermined. Which approach is most likely to overcome this mutual resistance?

   • ACreate a new security policy that holds developers personally accountable for any security incident.
   • BHave the security team conduct a security audit of the development team's code and report findings to management.
   • CEstablish a joint incident review process that is blameless and includes both teams, with a focus on systemic improvements.
   • DGive the security team the authority to override any development decision.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company has separate development, security, and operations teams that use different communication tools. Developers use Slack, security uses email, and operations uses a ticketing system. This has led to missed security alerts and delayed responses. Which change would most improve collaboration?

   • AHave the security team manually forward alerts to each team.
   • BRequire all teams to use email for security-related communication.
   • CCreate a new communication tool that all teams must use exclusively.
   • DIntegrate the tools so that security alerts are automatically posted to the team's Slack channel and create tickets in the operations system.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A large enterprise is trying to adopt DevSecOps, but the security team is used to being the final gatekeeper for all releases. The development teams want to deploy more frequently. The CISO wants to maintain security assurance while enabling faster delivery. Which approach best balances these conflicting goals?

   • AKeep the security team as the final approval authority but reduce the number of releases per month.
   • BAllow development teams to deploy without any security checks to speed up delivery.
   • CHave the security team review every change after it is deployed.
   • DImplement automated security checks in the pipeline and allow teams to self-serve deployments when checks pass, with security team oversight through dashboards and audits.
   Reveal Solution Discussion Select an answer first