Risk Management and Governance Flashcards

Which risk management framework is most commonly integrated with DevOps practices to ensure continuous compliance and governance?

Answer: NIST Risk Management Framework (RMF)

The NIST RMF provides a structured, flexible process for managing cybersecurity and operational risk that aligns naturally with DevOps continuous delivery cycles.

In a DevOps context, what does 'risk appetite' refer to?

Answer: The level and type of risk an organization is willing to accept in pursuit of its objectives

Risk appetite defines how much risk an organization is willing to take on to achieve its strategic goals, guiding DevOps teams on deployment frequency and change thresholds.

What is the primary purpose of a Change Advisory Board (CAB) in an ITSM-integrated DevOps environment?

Answer: To assess risk and authorize changes to minimize disruption to services

A CAB evaluates proposed changes for risk, impact, and urgency to ensure changes are authorized appropriately while minimizing service disruption.

Which approach best represents 'shifting governance left' in a DevOps pipeline?

Answer: Moving compliance checks and policy enforcement earlier into the development lifecycle

Shifting governance left embeds compliance checks, policy validation, and risk controls early in the pipeline (e.g., at code commit) rather than at the end, reducing costly late-stage failures.

A DevOps Leader is implementing Policy as Code. What is the primary benefit of this practice?

Answer: It enables automated, consistent enforcement of governance policies across all environments

Policy as Code automates governance by encoding rules in version-controlled scripts, enabling consistent, repeatable enforcement at scale without manual intervention.

In risk management, what is the difference between 'risk mitigation' and 'risk acceptance'?

Answer: Mitigation reduces the likelihood or impact of a risk, while acceptance acknowledges and tolerates a risk within defined thresholds

Risk mitigation involves taking actions to reduce risk probability or impact, while risk acceptance means acknowledging a risk and choosing to proceed because it falls within acceptable limits.

Which metric is most useful for measuring the effectiveness of risk management in a DevOps pipeline?

Answer: Mean Time to Detect (MTTD) and Mean Time to Recover (MTTR) from incidents

MTTD and MTTR directly measure an organization's ability to detect and respond to risks and failures, making them the most relevant indicators of risk management effectiveness.

What is 'Residual Risk' in the context of DevOps governance?

Answer: The risk that remains after controls and mitigation strategies have been applied

Residual risk is the remaining level of risk after all planned mitigation controls have been implemented, and it must be evaluated against the organization's risk tolerance.

Which governance model is most aligned with the DevOps principle of decentralized decision-making?

Answer: Federated governance, where teams operate autonomously within centrally defined guardrails

Federated governance balances autonomy and control by empowering teams to move fast while adhering to organizational standards, aligning with DevOps values.

What is the purpose of a Risk Register in a DevOps program?

Answer: To document identified risks, their likelihood, impact, owners, and mitigation actions

A Risk Register is a centralized document that captures all identified risks along with their attributes and mitigation plans, enabling ongoing risk monitoring and accountability.

In DevOps, how does 'immutable infrastructure' contribute to risk reduction?

Answer: It eliminates configuration drift by replacing instances rather than modifying them, reducing unpredictable behavior

Immutable infrastructure reduces risk by ensuring that running systems are never patched in place but replaced with freshly built, tested instances, eliminating configuration drift.

Which regulatory framework focuses specifically on protecting cardholder data and is relevant to DevOps teams handling payment systems?

Answer: PCI DSS

PCI DSS (Payment Card Industry Data Security Standard) governs how organizations handle, store, and transmit payment card data and directly impacts DevOps pipelines for financial applications.

What is a 'Chaos Engineering' experiment's primary role in risk management?

Answer: To proactively identify weaknesses in system resilience by injecting failures in a controlled way

Chaos Engineering proactively surfaces hidden risks by deliberately inducing failures in controlled environments, allowing teams to identify and fix weaknesses before they cause real outages.

A DevOps Leader wants to ensure audit trails for all pipeline activities. Which practice best supports this governance requirement?

Answer: Implementing comprehensive logging, versioning, and traceability across all pipeline stages

Automated logging, version control, and end-to-end traceability create immutable audit trails that satisfy governance and compliance requirements without manual overhead.

Which of the following best describes the 'Three Lines of Defense' model as applied to DevOps governance?

Answer: Business operations, risk/compliance functions, and internal audit providing layered oversight

The Three Lines of Defense model assigns governance roles to operational management (1st line), risk and compliance functions (2nd line), and internal audit (3rd line) for layered assurance.

What is the key difference between a 'vulnerability' and a 'threat' in risk management?

Answer: A vulnerability is a weakness that can be exploited, while a threat is a potential event that could exploit a vulnerability

A vulnerability is a weakness in the system, while a threat is a potential actor or event that could exploit that weakness to cause harm — both must be understood to assess risk.

Which risk treatment strategy is being applied when an organization purchases cyber insurance for its DevOps operations?

Answer: Risk transfer

Purchasing insurance is a form of risk transfer, shifting the financial consequences of a risk to a third party (the insurer) rather than bearing the full impact internally.

In a DevOps environment, what is the purpose of a 'Runbook' from a governance and risk perspective?

Answer: To provide standardized, documented procedures for operational tasks, reducing human error and ensuring consistent responses

Runbooks document step-by-step operational procedures, reducing risk from human error, ensuring consistency, and enabling faster recovery during incidents through repeatable processes.

What does 'Continuous Compliance' mean in a DevOps context?

Answer: Automating compliance checks throughout the delivery pipeline so that adherence to policies is continuously verified

Continuous Compliance integrates automated policy checks into the CI/CD pipeline so that every change is validated against compliance requirements in real time, not just at audit time.

A DevOps Leader identifies that a critical third-party API dependency has no SLA. Which risk response is most appropriate?

Answer: Implement a fallback mechanism and negotiate an SLA with the vendor while documenting the residual risk

The best response combines a technical mitigation (fallback) with a governance action (SLA negotiation) and proper risk documentation, balancing delivery continuity with risk management.