DevOps Culture, Fundamentals, and Maturity Models ECDE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A company is transitioning from a traditional siloed model to DevOps. They have a strong compliance requirement to maintain an audit trail of all production changes. The development team wants to deploy frequently, while operations is concerned about stability. Which approach best balances these competing needs?

   • AImplement a fully automated CI/CD pipeline with policy-as-code that enforces compliance checks and logs every deployment, but require a human approval for production releases.
   • BAllow developers to deploy directly to production without any approval, relying on automated tests to ensure stability.
   • CKeep the existing manual change-management process but reduce the approval time by having the change advisory board meet daily.
   • DCreate a separate release team that handles all production deployments, with developers handing off code to them.
   Reveal Solution Discussion Select an answer first
2. 27foundation · medium

   Which statement best reflects the DevSecOps principle of shared responsibility for security?

   • ASecurity is handled exclusively by automated tools, eliminating the need for human involvement.
   • BSecurity is the responsibility of the security team only, and other teams must follow their instructions.
   • CDevelopers, operations, and security professionals all contribute to security decisions and practices.
   • DSecurity is only considered during the final security review before production release.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A traditional IT organization is moving to DevOps. The operations team is used to being the only team allowed to deploy to production. The development team wants to deploy directly to production to speed up releases. Management wants to increase deployment frequency while ensuring that operations is not overwhelmed and that production remains stable. Which approach best balances these concerns?

   • AKeep operations as the only team that can deploy, but allow developers to submit deployment requests through a ticketing system.
   • BAllow developers to deploy directly to production without any involvement from operations.
   • CCreate a shared responsibility model where developers can deploy to production using automated pipelines, but operations provides the monitoring and rollback support.
   • DHave operations deploy all changes but use a fully automated pipeline to reduce manual effort.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An organization is using a DevOps maturity model to assess its current state. The assessment reveals that the organization has automated CI/CD pipelines and uses infrastructure as code, but teams still work in silos and there is no culture of shared responsibility. According to common maturity models, which area is most likely to be rated as immature?

   • AAutomated testing
   • BInfrastructure as code
   • CContinuous integration
   • DCulture and collaboration
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A company is assessing its DevSecOps maturity. They have automated security scanning in CI, but security findings are only reviewed by the security team, and developers are not required to fix them before release. The security team is overwhelmed and the backlog of findings is growing. Which change would most improve maturity?

   • AMake developers responsible for fixing security findings in their code, with the security team providing guidance and reviewing critical issues.
   • BIncrease the size of the security team to review all findings.
   • CDisable the automated scanner to reduce the backlog.
   • DHave the security team prioritize findings and only fix the critical ones themselves.
   Reveal Solution Discussion Select an answer first