Integrating Security into DevOps and the Shift-Left Approach ECDE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A company is adopting DevSecOps, but the security team is used to being the sole authority on security decisions. Developers want to move faster and are pushing to automate security checks. The security team fears losing control. Which approach best fosters collaboration while maintaining security oversight?

   • AKeep all security decisions with the security team and have them manually approve every pipeline change.
   • BCreate a joint security and development working group that defines automated security policies together, with the security team retaining final approval on policy changes.
   • CLet developers define all security policies and automate them without security team involvement.
   • DHave the security team write all security automation and hand it to developers to run.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the primary role of continuous security monitoring in a DevSecOps environment?

   • ATo provide ongoing visibility into security posture and detect threats in real time
   • BTo replace the need for automated security testing in the pipeline
   • CTo perform a one-time security assessment before launch
   • DTo ensure that all security vulnerabilities are automatically patched without human intervention
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A DevSecOps team has implemented continuous monitoring in production. They are receiving a high volume of alerts, many of which are not actionable. The team is spending too much time triaging alerts and is missing real incidents. Which improvement best addresses this problem?

   • ATune alert rules to reduce false positives and correlate alerts into meaningful incidents.
   • BAssign a dedicated person to review every alert manually.
   • CIncrease the number of alerts to ensure no incident is missed.
   • DDisable all alerts and rely on manual log review.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company wants to ensure that all infrastructure changes are secure and compliant. They plan to use infrastructure as code (IaC) and want to integrate security into the pipeline. Which approach best combines security as code with the IaC workflow?

   • AUse the same IaC templates without any security checks because they are already approved.
   • BHave a security engineer manually review the IaC templates after deployment.
   • COnly run a compliance report at the end of each month.
   • DUse a policy-as-code tool to scan the IaC templates for misconfigurations and security violations before deployment.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An organization is adopting DevSecOps. The security team is used to being the sole owner of security decisions, while developers focus only on features. The leadership wants to promote shared responsibility. Which action best supports this cultural change?

   • AAllow developers to make all security decisions without security team input.
   • BKeep security decisions centralized in the security team and only inform developers of final decisions.
   • CDefine security ownership in the team charter and include security tasks in the definition of done for every user story.
   • DHave the security team perform all security tasks without involving developers.
   Reveal Solution Discussion Select an answer first