Integrating Security into DevOps and the Shift-Left Approach ECDE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What does the concept of 'security as code' primarily involve?

   • APerforming security testing only at the end of the pipeline
   • BHiring more security engineers to manually review code
   • CWriting security policies and controls in a machine-readable format that can be versioned and automated
   • DUsing a single security tool for all testing needs
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A development team is new to shift-left security and is overwhelmed by the number of vulnerabilities reported by SAST. Many findings are false positives, and developers have started ignoring the scan results. What is the best first step to improve the situation?

   • ARequire developers to fix every reported finding, regardless of validity.
   • BIncrease the scan frequency to generate more data for the security team.
   • CRemove SAST from the pipeline and rely on manual code reviews.
   • DTune the SAST rules and establish a triage process to reduce noise and prioritize real issues.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   An organization is transitioning to DevSecOps. The development team is measured on feature delivery speed, while the security team is measured on the number of vulnerabilities found. This has created conflicting incentives and tension. Which change best aligns the teams toward shared security goals?

   • ARemove all security metrics and only measure delivery speed.
   • BKeep the current metrics but add a bonus for the security team when they find more vulnerabilities.
   • CAdopt shared metrics that reward both fast delivery and secure outcomes, such as mean time to remediate and vulnerability escape rate.
   • DHave the security team report directly to the development manager.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A startup is building a new product and wants to adopt shift-left security from the start. They have a small team and limited budget. They need to choose which security tools to integrate into their CI pipeline. Which approach provides the best security value for their constraints?

   • AImplement only manual security reviews because they are free.
   • BStart with free or open-source SAST and dependency scanning tools, and add DAST later as the product matures.
   • CPurchase an expensive enterprise DAST tool and run it only on release candidates.
   • DWait until the product is mature before adding any security testing.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which collaboration practice helps break down silos between development, operations, and security teams?

   • AAssigning security tasks only to the security team
   • BHaving security teams work in isolation until the final release
   • CUsing a shared set of tools and metrics across all teams
   • DKeeping security findings confidential to avoid blame
   Reveal Solution Discussion Select an answer first