Sample questions
Ds Security Metrics Blameless CultureDifficulty 1
A DevSecOps team tracks Mean Time to Remediate (MTTR) for vulnerabilities found in their pipeline. What does this metric primarily tell the team?
- aHow quickly, on average, a discovered vulnerability is fixed and closed after it is first reported.✓
- bHow many total vulnerabilities exist across all repositories regardless of severity or age.
- cWhich specific engineer introduced the largest number of vulnerabilities into the codebase.
- dWhether the scanning tool itself is configured correctly and produces zero false positives.
Explanation:MTTR measures the average time elapsed between a vulnerability's discovery and its remediation, so it reflects how fast the organization responds to known risk, not the total volume of findings or tool accuracy.
Ds Security Metrics Blameless CultureDifficulty 1
A vulnerability management program defines separate remediation SLAs for critical, high, medium, and low severity findings. Why use tiered SLAs instead of one single deadline for every finding?
- aTiered SLAs are required by law in every jurisdiction, so a single deadline would be illegal to enforce.
- bTiered SLAs let the security team ignore low-severity findings permanently without any tracking.
- cTiered SLAs guarantee that no vulnerability will ever be exploited before its deadline arrives.
- dTiered SLAs focus limited remediation effort on the findings that carry the most real risk first.✓
Explanation:Severity-based SLAs let teams prioritize scarce engineering time toward the highest-risk findings, giving critical issues the shortest deadlines while lower-risk findings still get tracked on a longer, realistic timeline.
Ds Security Metrics Blameless CultureDifficulty 1
What is the core goal of a blameless postmortem after a security incident?
- aTo determine which individual should be formally disciplined or reprimanded for the incident.
- bTo understand the contributing systemic and process factors so similar incidents are less likely to recur.✓
- cTo keep the details of the incident private from the engineering team so morale is not affected.
- dTo assign a monetary cost to the incident purely for insurance and legal reporting purposes.
Explanation:A blameless postmortem treats the incident as a signal about systems and processes rather than individual failure, aiming to surface the real contributing factors so the organization can fix them and reduce recurrence.
Ds Security Metrics Blameless CultureDifficulty 2
During a blameless postmortem, a facilitator asks the team to describe the incident timeline. One participant says: "It was clearly Ahmet's fault for deploying without a review." What is the most appropriate way for the facilitator to redirect this comment?
- aAgree openly, and add Ahmet's name to the postmortem document as the responsible party.
- bAsk Ahmet to leave the meeting so the rest of the team can discuss the incident without him.
- cEnd the postmortem early, since naming an individual means the process has already failed.
- dReframe the discussion toward why the deploy process allowed an unreviewed change to reach production.✓
Explanation:A blameless facilitator redirects individual-blame statements toward systemic questions: why did the process allow this to happen, and what guardrail or check was missing, rather than singling out a person.
Ds Security Metrics Blameless CultureDifficulty 1
In a security champion program, what is a security champion?
- aA dedicated full-time security engineer embedded permanently inside every product team's headcount, separate from any existing engineering role.
- bAn external auditor hired once a year to certify the team's compliance with a specific standard.
- cA developer on a product team who receives extra security training and acts as a local point of contact.✓
- dA software tool that automatically blocks any pull request containing a detected vulnerability.
Explanation:A security champion is typically a developer already on the team, given extra training and a liaison role with the central security function, not a separate headcount, external auditor, or automated tool.
Ds Security Metrics Blameless CultureDifficulty 2
A company wants a basic way to gauge whether its security champion program is actually working. Which measurement gives the most direct signal?
- aComparing security-relevant defect rates and review turnaround in teams with an active champion versus those without.✓
- bCounting how many champions attended the kickoff meeting when the program was first announced.
- cChecking whether every champion has the exact same job title printed on the company directory.
- dMeasuring how many stickers or badges were printed for champions during the program launch.
Explanation:A meaningful signal compares outcomes, such as security defect rates or review speed, between teams with and without an active champion, rather than superficial attendance or branding metrics.