Sample questions
Ds Shift Left Security CultureDifficulty 1
What does "shift-left security" mean in software delivery?
- aIntroducing security activities earlier in the lifecycle, starting at design and coding✓
- bMoving all security testing to a dedicated team right before the production release date
- cRelocating the security team's office closer to the operations team for faster incident response
- dReplacing manual code review entirely with automated scanning tools in the CI pipeline
Explanation:Shift-left means moving security work earlier in the lifecycle (requirements, design, coding) instead of concentrating it right before release. It is about timing of activities, not about team location or fully replacing manual review with tooling.
Ds Shift Left Security CultureDifficulty 2
Why is finding a design-level security flaw during sprint planning generally cheaper than finding the same flaw after release?
- aBecause the design can still be changed without rework on already-built and deployed code✓
- bBecause production incidents are always caused by design flaws rather than coding mistakes
- cBecause sprint planning meetings automatically include a dedicated penetration tester
- dBecause compliance auditors only review findings that are reported during planning meetings
Explanation:The earlier a flaw is caught, the less has been built on top of the flawed assumption. Catching it at design time means changing a diagram or a story; catching it after release means reworking deployed code, migrating data, and possibly handling an incident.
Ds Shift Left Security CultureDifficulty 1
In a security champion program, what is the primary role of a "security champion"?
- aAn external consultant hired only during compliance audit season to sign off on controls
- bA full-time member of the central security team who audits every pull request across the company
- cAn engineer embedded in a product team who keeps their regular engineering job while acting as the local point of contact and advocate for security✓
- dA manager who approves security budget requests without doing any hands-on technical work
Explanation:A security champion is embedded in a product team, keeps doing their regular engineering job, and acts as the local point of contact and advocate for security practices, bridging the team and the central security function.
Ds Shift Left Security CultureDifficulty 2
A team is writing a user story for a new feature that will let users upload profile photos. When should the team first think about what could go wrong from a security perspective?
- aOnly after a customer reports that they were able to upload an unexpected file type
- bDuring the final regression test pass, right before the release is tagged
- cNever, because profile photo upload is considered too minor a feature to warrant it
- dWhile writing and refining the story itself, before implementation starts✓
Explanation:Lightweight threat consideration belongs in story writing and refinement, before code is written. Waiting for a customer report or the final regression pass means the risky design decisions (file type validation, storage, size limits) are already baked in.
Ds Shift Left Security CultureDifficulty 1
What is "security debt" in the context of a product backlog?
- aThe total amount of money a company owes to a third-party security vendor for annual licenses
- bA known, accepted weakness tracked as a backlog item to be fixed later, not right now✓
- cA fine imposed by a regulator after a data breach is discovered and reported
- dThe interest rate applied to a company's cyber-insurance premium each renewal cycle
Explanation:Security debt is the security equivalent of technical debt: a known weakness that the team consciously decides not to fix right now, tracked explicitly so it is not forgotten and can be prioritized later.
Ds Shift Left Security CultureDifficulty 2
A company rolls out a mandatory annual security awareness training video for all developers. Why might completion rate alone be a poor measure of the training's effectiveness?
- aCompletion rate cannot be measured automatically by any learning management system
- bAnnual trainings are always illegal under most data protection regulations
- cCompletion only shows the video was watched, not that code-writing behavior changed afterward✓
- dDevelopers are legally required to skip the training if it takes longer than one hour
Explanation:Completion is a process metric: it tells you people clicked through the material. It says nothing about whether behavior changed, such as fewer recurring vulnerability classes in code review or SAST results after the training.