Integrating Security into DevOps and the Shift-Left Approach ECDE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company is comparing two approaches: running SAST only at the end of the release cycle versus integrating SAST into the CI pipeline on every commit. The team wants to minimize the total cost of fixing vulnerabilities. Which statement best reflects the cost benefit of the shift-left approach?

   • AThe cost of fixing a vulnerability is the same regardless of when it is found.
   • BFixing a vulnerability found during development is generally less expensive than fixing the same vulnerability after release.
   • CEnd-of-cycle SAST is cheaper because it scans the final codebase only once.
   • DRunning SAST on every commit increases tooling costs, so the total cost is always higher than end-of-cycle testing.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A DevSecOps team has implemented automated security testing in the CI/CD pipeline. They now want to ensure that security issues discovered in production are fed back into the development process to prevent recurrence. Which practice best establishes this feedback loop?

   • AIntegrate security monitoring alerts with the incident management system and automatically create work items in the development backlog with relevant details.
   • BRely on the security team to manually inform developers of issues during the next release planning meeting.
   • CLog security incidents in a separate system that only the security team can access.
   • DSend a monthly email summary of security incidents to the development team.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A DevSecOps team is struggling to get developers to run security scans locally before pushing code. The scans are slow and require a specific setup. The team wants to encourage early detection without slowing down developers. Which approach is most effective?

   • AHave a security engineer run scans for developers and report back.
   • BProvide a lightweight, pre-commit hook that runs a fast subset of security checks, and run the full scans in CI.
   • CRequire developers to run the full SAST scan locally before every push.
   • DMove all security scanning to CI and tell developers not to worry about local scans.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A large enterprise is shifting security left. The security team wants to enforce a strict policy that all SAST findings must be fixed before merge. Developers argue this will slow delivery, and the team is split. Which approach best balances security and velocity while maintaining a shift-left culture?

   • ABlock merge for all SAST findings, regardless of severity, to ensure no vulnerabilities enter the codebase.
   • BAllow all findings to merge and rely on a monthly security review to fix them later.
   • CHave the security team manually review every SAST finding before merge.
   • DImplement a risk-based policy that blocks merge only for critical and high-severity findings, and tracks medium/low findings as work items.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An organization is starting a shift-left security initiative. The security team is concerned that developers lack security expertise and that adding security checks will slow down the CI pipeline. Which best practice addresses both concerns?

   • AHave the security team manually review every code change before merge.
   • BDeploy a comprehensive set of security tools immediately and require developers to fix all findings.
   • CProvide security training to developers and start with a small set of high-value automated checks, then gradually expand.
   • DRun all security checks only at the end of the release cycle to avoid slowing down the pipeline.
   Reveal Solution Discussion Select an answer first