Building a DevSecOps Culture ECDE Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   Which approach is most likely to encourage teams to embrace DevSecOps practices?

   • AUsing a new security tool without providing any training or support.
   • BAssigning security tasks exclusively to a separate security team.
   • CProviding training and aligning incentives with security and delivery goals.
   • DRewarding only speed of delivery, regardless of security outcomes.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A development team is resistant to adding security scanning to their CI/CD pipeline because they believe it will slow down their builds. Which approach best overcomes this resistance?

   • AAdd a comprehensive security scan that runs at the end of the pipeline and blocks releases.
   • BRemove all security scanning to keep the build fast.
   • CStart with fast, incremental scans that run in parallel with the build and show the team the actual time impact.
   • DTell the team that security is non-negotiable and they must accept the slowdown.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   In a DevSecOps environment, what does 'security as a shared responsibility' mean for a developer?

   • ADevelopers are not responsible for security until after deployment.
   • BDevelopers only need to report security issues to the security team.
   • CDevelopers must become security experts and perform all security testing manually.
   • DDevelopers are responsible for writing secure code and using security tools in their CI/CD pipeline.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A DevSecOps team wants to improve communication between developers and security engineers. Currently, security findings are only discussed in a monthly meeting. Which change would most effectively create a continuous feedback loop?

   • ACreate a shared spreadsheet of security findings and ask developers to check it before each release.
   • BHave the security team present a quarterly report on security trends.
   • CIntegrate security scanning results directly into the developers' pull request workflow so they see findings in the same interface they use daily.
   • DSend a weekly email digest of security findings to all developers.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A company is trying to implement DevSecOps, but the development team is resistant because they feel security requirements are always changing and are not communicated clearly. What is the best way to overcome this resistance?

   • AAsk developers to attend a security conference to learn about new requirements.
   • BEstablish a joint security and development working group that reviews and communicates security requirements on a regular cadence.
   • CFreeze all security requirements for the next six months to give developers stability.
   • DHave the security team write a comprehensive requirements document and email it to developers once.
   Reveal Solution Discussion Select an answer first