DevOps Culture, Fundamentals, and Maturity Models ECDE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A DevOps maturity assessment reveals that the organization has a high level of automation, but deployment failures are frequent and teams often blame each other. The assessment recommends focusing on improving the 'culture' dimension. Which action would most directly improve that dimension?

   • AConduct a blameless post-incident review after each deployment failure.
   • BAdd more automated tests to the CI pipeline.
   • CIncrease the number of staging environments.
   • DImplement a stricter change management process.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company is using a maturity model to evaluate its DevOps adoption. They have automated infrastructure provisioning, but they still have separate teams for development and operations with limited communication. Which dimension of the maturity model is likely to be rated lowest?

   • ACulture and organization, because the teams are still siloed.
   • BAutomation, because they have automated infrastructure provisioning.
   • CContinuous delivery, because they have not mentioned deployment automation.
   • DMonitoring and feedback, because there is no mention of monitoring.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A team is assessing its DevOps maturity and finds that security reviews are performed only at the end of the release cycle. They want to improve their maturity in the security dimension. Which improvement aligns with a higher maturity level?

   • AHave the security team write a security requirements document that developers must follow.
   • BMove the security review to after production deployment to avoid delaying releases.
   • CAdd automated security scanning to the CI pipeline and require developers to fix critical findings before merge.
   • DKeep the end-of-cycle security review but add more security testers to speed it up.
   Reveal Solution Discussion Select an answer first
5. 24application · medium · select all that apply

   A company is adopting DevSecOps practices. The security team currently performs a manual penetration test after each release. The company wants to shift security left and integrate security into the CI/CD pipeline. Which practices align with DevSecOps culture? Select all that apply.

   • AScan container images for known vulnerabilities before deploying to production.
   • BPerform a full penetration test only after the application is deployed to production.
   • CProvide developers with security training and access to security tools.
   • DRun automated static application security testing (SAST) as part of the CI pipeline.
   • ERequire a manual security review by the security team before every production deployment.
   Check answers Discussion Select an answer first
6. 25application · medium

   A team is implementing continuous delivery for a web application. They have automated the build and test stages, and every commit to the main branch produces a deployable artifact. However, they are not yet ready for continuous deployment because the business requires a human approval before production releases. Which practice best describes their current state?

   • AContinuous integration only
   • BContinuous deployment
   • CContinuous delivery
   • DRelease management
   Reveal Solution Discussion Select an answer first