Building a DevSecOps Culture ECDE Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A company is adopting DevSecOps. The security team currently owns all security decisions and reviews every code change. Developers are frustrated because reviews are slow. The company wants to speed up delivery while maintaining security. Which approach best balances these competing needs?

   • AIncrease the security team's size so they can review every change faster.
   • BHave developers self-review their own code for security issues without any automated checks.
   • CImplement automated security checks in the CI pipeline and have the security team focus on defining policies and reviewing high-risk changes.
   • DRemove the security review requirement for all changes to speed up delivery.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   An organization wants to adopt DevSecOps, but middle managers are hesitant because they fear losing control over their teams. Which strategy is most likely to gain their buy-in?

   • AReplace middle managers with self-organizing teams that report directly to the CISO.
   • BInvolve middle managers in designing the new DevSecOps processes and give them clear metrics to track team performance.
   • CProvide DevSecOps training only to individual contributors and let them drive the change.
   • DAnnounce the change at a company-wide meeting and require all teams to adopt it immediately.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A DevSecOps team is reviewing its practices. They notice that security issues are often found only after deployment. Which change best embodies the principle of continuous improvement?

   • AIncrease the frequency of manual security audits after deployment.
   • BDocument the issues found after deployment and share the report with management.
   • CBlame the team that deployed the vulnerable code to encourage better behavior.
   • DAdd automated security scanning to the CI pipeline and review the results in the next retrospective.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A traditional enterprise has separate development, security, and operations teams that rarely communicate. The CISO wants to adopt DevSecOps but the security team fears losing control and developers see security as a bottleneck. Which strategy is most effective for shifting the culture?

   • AProvide security training to developers and then hold them solely accountable for fixing vulnerabilities.
   • BStart with a small pilot team that includes members from all three groups, and have them jointly define a shared security goal.
   • CMandate that all security testing be automated and remove manual security reviews entirely.
   • DCreate a new security gate at the end of the pipeline that blocks any release with a high-severity finding.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security team is reluctant to adopt DevSecOps because they fear that automating security checks will reduce their role to just fixing false positives. What is the best way to address this concern?

   • AAssure the security team that they will still manually review every automated finding.
   • BDelay automation until the security team is comfortable with the idea.
   • CHave the security team focus on writing reports for management about automated findings.
   • DRedefine the security team's role to focus on threat modeling, policy design, and handling complex escalations from automated checks.
   Reveal Solution Discussion Select an answer first