Building a DevSecOps Culture ECDE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   In a DevSecOps environment, a developer discovers a misconfiguration in a production database that could expose customer data. The developer is not part of the operations team. What is the most appropriate action for the developer to take?

   • AReport the issue to the security team only and take no further action.
   • BIgnore it because database configuration is not the developer's responsibility.
   • CFix the misconfiguration immediately if they have the access and then notify the operations team.
   • DLog the issue in the ticketing system and wait for the operations team to fix it.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which common barrier to DevSecOps adoption is best addressed by providing hands-on training and safe sandbox environments?

   • ALack of executive sponsorship.
   • BInsufficient budget for new tools.
   • CLack of skills and fear of making mistakes.
   • DRegulatory compliance requirements.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A mid-sized company is trying to shift to DevSecOps. The development teams are enthusiastic, but the operations team is reluctant because they have been blamed for past outages. Which strategy best addresses this barrier?

   • AImplement a new incident management tool and let the operations team use it independently.
   • BRequire the operations team to attend more training sessions on DevSecOps tools.
   • CCreate a blameless post-incident review process and publicly recognize teams for identifying and fixing issues.
   • DTransfer the operations team to a different department to reduce friction.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An organization is trying to adopt DevSecOps, but the operations team is resistant because they are used to being the only team with production access. Which strategy is most effective in reducing this resistance?

   • AImmediately give all developers full administrative access to production.
   • BCreate a new team that manages all production access and removes operations' access.
   • CGradually grant developers read-only access to production logs and monitoring dashboards.
   • DKeep production access exclusively with operations and have them run all security checks.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company is moving to a DevSecOps model. The operations team currently manages infrastructure manually and the security team only reviews systems after deployment. The company wants to improve collaboration and make security a shared responsibility. Which action best supports this goal?

   • AHave the security team write a detailed security checklist that operations must follow after each deployment.
   • BCreate a shared on-call rotation that includes developers, security engineers, and operations staff for production incidents.
   • CAsk developers to document all security requirements in a wiki that operations can consult.
   • DLet each team continue its current process but hold a monthly meeting to discuss security incidents.
   Reveal Solution Discussion Select an answer first