Building a DevSecOps Culture ECDE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A DevSecOps team wants to use metrics to reinforce a culture of shared responsibility. Which metric would best encourage developers to take ownership of security?

   • ATotal number of security tools used in the pipeline.
   • BNumber of security incidents reported by customers.
   • CTime spent by the security team on manual reviews.
   • DPercentage of security findings remediated by the team that introduced them.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A company is adopting DevSecOps, but the security team is overwhelmed by the number of alerts from the new automated scanning tools. They are considering disabling the tools to reduce noise. What is the best course of action?

   • ADisable the tools until the team has more time to review alerts.
   • BIncrease the severity threshold so only critical alerts are shown.
   • CAssign one person to review all alerts manually.
   • DTune the scanning tools to reduce false positives and prioritize alerts based on risk.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which approach is most effective for overcoming resistance to a DevSecOps cultural change?

   • AInvolving team members early in the change process and addressing their concerns openly.
   • BFocusing only on tool adoption and ignoring the human aspects of change.
   • CKeeping the change details confidential until the rollout is complete.
   • DImplementing the change quickly and punishing those who do not comply.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A security manager is skeptical about DevSecOps because they believe that giving developers access to security tools will lead to uncoordinated and inconsistent security decisions. What is the most effective way to address this concern?

   • AEstablish a security champions program where selected developers receive extra training and act as liaisons to the security team.
   • BGive all developers full access to all security tools and let them decide how to use them.
   • CProhibit developers from using security tools and keep all security decisions with the security team.
   • DAsk the security manager to approve every security tool configuration change before it is applied.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A company is trying to foster collaboration between development, security, and operations teams. They have tried using a shared chat channel, but the security team rarely participates because they feel their input is ignored. What is the most effective way to increase security team participation?

   • ACreate a separate security-only channel where they can discuss issues among themselves.
   • BEncourage the security team to post more messages in the shared chat channel.
   • CEstablish a formal process where security team members are assigned to each development team and have a defined role in sprint planning and reviews.
   • DHave the development team lead review all security comments and decide which to act on.
   Reveal Solution Discussion Select an answer first