Covers DevOps culture and the DevSecOps pipeline, threat modeling and secret management, static and dynamic security testing, runtime protection and infrastructure-as-code security.
12 free sample questions159 in the full practice test
Understanding DevOps Culture · DevOps Culture and Principles
A traditional financial institution is transitioning from a Waterfall SDLC to a DevOps methodology. The organization currently suffers from long release cycles and frequent deployment failures due to misaligned environments. Which of the following represents the most critical cultural shift the organization must achieve to successfully implement DevOps principles?
Answer and explanation
Correct answer: B
The core of DevOps is a cultural transformation that breaks down silos between development and operations teams. While automation and cloud technologies are enablers, the fundamental requirement is adopting a shared responsibility model where both teams collaborate throughout the entire lifecycle. Without this cultural shift, merely adopting new tools will not resolve the underlying communication and alignment issues.
Q2Question 2
Beginner
Understanding DevOps Culture · CI/CD Fundamentals
When distinguishing between the core components of CI/CD, which statement accurately differentiates Continuous Delivery from Continuous Deployment?
Answer and explanation
Correct answer: B
Continuous Delivery means the software is always in a deployable state, but the actual release to production is a manual business decision. Continuous Deployment takes this a step further by removing the manual gate, automatically deploying every change that passes the automated test suite directly to production.
Q3Question 3
Beginner
Understanding DevOps Culture · DevOps Culture and Principles
True or False: In a mature DevOps culture, the development team assumes sole responsibility for application functionality and code quality, while the operations team assumes sole responsibility for infrastructure uptime and scalability.
Answer and explanation
Correct answer: B
False. A mature DevOps culture relies heavily on a model of 'shared responsibility'. Developers take ownership of how their code performs in production (including uptime considerations), and operations teams are involved earlier in the lifecycle to understand application architecture. Siloed responsibilities contradict DevOps principles.
An organization is migrating its on-premises CI/CD pipeline to a fully cloud-native architecture on AWS. They need to replace their self-hosted Jenkins server and local Git repositories with managed AWS services. Which TWO of the following AWS services should the architect select to achieve this? (Select TWO)
Answer and explanation
Correct answers: A, C
AWS CodeCommit is a managed source control service that hosts secure Git-based repositories, serving as a direct replacement for local Git servers.
AWS CodePipeline is a fully managed continuous delivery service that automates release pipelines, serving as a cloud-native replacement for orchestration tools like Jenkins.
A large healthcare provider is attempting to modernize its software delivery by adopting DevOps. Currently, they operate in strict silos: Developers write code and throw it over the wall to QA, who tests it manually for 3 weeks. Once approved, it is handed to the Security team, who performs a 2-week audit. Finally, Operations schedules a deployment window over a weekend.
The CIO wants to reduce the lead time from 6 weeks to 2 days. The Security Director is highly resistant, claiming that faster releases will inherently compromise HIPAA compliance and increase the risk of data breaches. The Operations Manager is concerned about deployment failures causing downtime.
As the lead DevSecOps architect, you must propose an initial strategy that addresses the cultural resistance while technically enabling the CIO's goal. Which approach represents the BEST initial step to break down these silos and accelerate the pipeline without sacrificing security?
The most effective way to break down silos and overcome cultural resistance is to create cross-functional teams where all stakeholders collaborate on the solution. By involving Security and Ops in building the automated pipeline and shifting security left (SAST/SCA), the organization can accelerate delivery while actually improving security and stability, addressing the concerns of both the Security Director and Operations Manager.
Q6Question 6
Beginner
Introduction to DevSecOps · DevSecOps Principles and Philosophy
The principle of "Shift-Left" is foundational to DevSecOps. Which of the following best defines this concept?
Answer and explanation
Correct answer: B
Shift-left refers to moving security considerations, testing, and validations earlier (to the "left") in the software development lifecycle (SDLC). Instead of waiting until the release or deployment stage to test for vulnerabilities, shift-left incorporates threat modeling during planning, SAST during coding, and automated testing during the build phase.
Register free for 6 more questions
Or unlock all 159 312-97 questions with explanations, timed mode and flashcards.
