DOL Risk Management and Governance — Questions and Answers

Question 1: Which risk management framework is most commonly integrated with DevOps practices to ensure continuous compliance and governance?

COSO ERM
NIST Risk Management Framework (RMF) (Correct answer)
Six Sigma DMAIC
PRINCE2

Correct answer: NIST Risk Management Framework (RMF)

The NIST RMF provides a structured, flexible process for managing cybersecurity and operational risk that aligns naturally with DevOps continuous delivery cycles.

Question 2: In a DevOps context, what does 'risk appetite' refer to?

The number of deployments an organization can handle per day
The level and type of risk an organization is willing to accept in pursuit of its objectives (Correct answer)
The budget allocated for disaster recovery planning
The tolerance for technical debt in a codebase

Correct answer: The level and type of risk an organization is willing to accept in pursuit of its objectives

Risk appetite defines how much risk an organization is willing to take on to achieve its strategic goals, guiding DevOps teams on deployment frequency and change thresholds.

Question 3: What is the primary purpose of a Change Advisory Board (CAB) in an ITSM-integrated DevOps environment?

To approve all code merges into the main branch
To assess risk and authorize changes to minimize disruption to services (Correct answer)
To manage the backlog of feature requests from stakeholders
To oversee the hiring and training of DevOps engineers

Correct answer: To assess risk and authorize changes to minimize disruption to services

A CAB evaluates proposed changes for risk, impact, and urgency to ensure changes are authorized appropriately while minimizing service disruption.

Question 4: Which approach best represents 'shifting governance left' in a DevOps pipeline?

Moving compliance checks and policy enforcement earlier into the development lifecycle (Correct answer)
Delegating all governance responsibilities to development teams only
Applying governance reviews only at the production release stage
Removing governance controls to accelerate deployment speed

Correct answer: Moving compliance checks and policy enforcement earlier into the development lifecycle

Shifting governance left embeds compliance checks, policy validation, and risk controls early in the pipeline (e.g., at code commit) rather than at the end, reducing costly late-stage failures.

Question 5: A DevOps Leader is implementing Policy as Code. What is the primary benefit of this practice?

It replaces the need for security audits entirely
It enables automated, consistent enforcement of governance policies across all environments (Correct answer)
It allows developers to bypass security reviews for faster delivery
It centralizes all policy decisions within the operations team

Correct answer: It enables automated, consistent enforcement of governance policies across all environments

Policy as Code automates governance by encoding rules in version-controlled scripts, enabling consistent, repeatable enforcement at scale without manual intervention.

Question 6: In risk management, what is the difference between 'risk mitigation' and 'risk acceptance'?

Mitigation eliminates risk entirely, while acceptance ignores it
Mitigation reduces the likelihood or impact of a risk, while acceptance acknowledges and tolerates a risk within defined thresholds (Correct answer)
Mitigation is proactive and acceptance is reactive
Mitigation is for technical risks only, while acceptance applies to business risks

Correct answer: Mitigation reduces the likelihood or impact of a risk, while acceptance acknowledges and tolerates a risk within defined thresholds

Risk mitigation involves taking actions to reduce risk probability or impact, while risk acceptance means acknowledging a risk and choosing to proceed because it falls within acceptable limits.

Question 7: Which metric is most useful for measuring the effectiveness of risk management in a DevOps pipeline?

Lines of code written per sprint
Mean Time to Detect (MTTD) and Mean Time to Recover (MTTR) from incidents (Correct answer)
Number of user stories completed per release
Total number of automated tests in the test suite

Correct answer: Mean Time to Detect (MTTD) and Mean Time to Recover (MTTR) from incidents

MTTD and MTTR directly measure an organization's ability to detect and respond to risks and failures, making them the most relevant indicators of risk management effectiveness.

Question 8: What is 'Residual Risk' in the context of DevOps governance?

Risk that has been fully eliminated by controls
The risk that remains after controls and mitigation strategies have been applied (Correct answer)
Risk transferred to a third-party vendor
Risk identified but not yet assigned to an owner

Correct answer: The risk that remains after controls and mitigation strategies have been applied

Residual risk is the remaining level of risk after all planned mitigation controls have been implemented, and it must be evaluated against the organization's risk tolerance.

Question 9: Which governance model is most aligned with the DevOps principle of decentralized decision-making?

Federated governance, where teams operate autonomously within centrally defined guardrails (Correct answer)
Centralized governance, where all decisions go through a single approval committee
Hierarchical governance, where senior management approves every deployment
Vendor-driven governance, where tool vendors define compliance requirements

Correct answer: Federated governance, where teams operate autonomously within centrally defined guardrails

Federated governance balances autonomy and control by empowering teams to move fast while adhering to organizational standards, aligning with DevOps values.

Question 10: What is the purpose of a Risk Register in a DevOps program?

To track the performance of individual developers
To document identified risks, their likelihood, impact, owners, and mitigation actions (Correct answer)
To store configuration management data for all environments
To list all approved third-party software libraries

Correct answer: To document identified risks, their likelihood, impact, owners, and mitigation actions

A Risk Register is a centralized document that captures all identified risks along with their attributes and mitigation plans, enabling ongoing risk monitoring and accountability.

Question 11: In DevOps, how does 'immutable infrastructure' contribute to risk reduction?

It prevents developers from making any code changes
It eliminates configuration drift by replacing instances rather than modifying them, reducing unpredictable behavior (Correct answer)
It locks down all network traffic between services
It ensures all team members have identical development environments only

Correct answer: It eliminates configuration drift by replacing instances rather than modifying them, reducing unpredictable behavior

Immutable infrastructure reduces risk by ensuring that running systems are never patched in place but replaced with freshly built, tested instances, eliminating configuration drift.

Question 12: Which regulatory framework focuses specifically on protecting cardholder data and is relevant to DevOps teams handling payment systems?

HIPAA
SOX
PCI DSS (Correct answer)
GDPR

Correct answer: PCI DSS

PCI DSS (Payment Card Industry Data Security Standard) governs how organizations handle, store, and transmit payment card data and directly impacts DevOps pipelines for financial applications.

Question 13: What is a 'Chaos Engineering' experiment's primary role in risk management?

To intentionally break production systems for entertainment
To proactively identify weaknesses in system resilience by injecting failures in a controlled way (Correct answer)
To test whether developers can work under stressful conditions
To validate that backups are correctly configured after an incident

Correct answer: To proactively identify weaknesses in system resilience by injecting failures in a controlled way

Chaos Engineering proactively surfaces hidden risks by deliberately inducing failures in controlled environments, allowing teams to identify and fix weaknesses before they cause real outages.

Question 14: A DevOps Leader wants to ensure audit trails for all pipeline activities. Which practice best supports this governance requirement?

Requiring developers to submit written reports after each deployment
Implementing comprehensive logging, versioning, and traceability across all pipeline stages (Correct answer)
Limiting access to production environments to senior staff only
Conducting monthly manual audits of all deployment records

Correct answer: Implementing comprehensive logging, versioning, and traceability across all pipeline stages

Automated logging, version control, and end-to-end traceability create immutable audit trails that satisfy governance and compliance requirements without manual overhead.

Question 15: Which of the following best describes the 'Three Lines of Defense' model as applied to DevOps governance?

Development, Testing, and Production teams acting independently
Business operations, risk/compliance functions, and internal audit providing layered oversight (Correct answer)
Frontend, backend, and infrastructure teams sharing governance responsibilities
Planning, execution, and review phases of a sprint

Correct answer: Business operations, risk/compliance functions, and internal audit providing layered oversight

The Three Lines of Defense model assigns governance roles to operational management (1st line), risk and compliance functions (2nd line), and internal audit (3rd line) for layered assurance.

Question 16: What is the key difference between a 'vulnerability' and a 'threat' in risk management?

A vulnerability is external and a threat is internal
A vulnerability is a weakness that can be exploited, while a threat is a potential event that could exploit a vulnerability (Correct answer)
A vulnerability is a known issue and a threat is unknown
A vulnerability affects software only, while a threat affects infrastructure only

Correct answer: A vulnerability is a weakness that can be exploited, while a threat is a potential event that could exploit a vulnerability

A vulnerability is a weakness in the system, while a threat is a potential actor or event that could exploit that weakness to cause harm — both must be understood to assess risk.

Question 17: Which risk treatment strategy is being applied when an organization purchases cyber insurance for its DevOps operations?

Risk avoidance
Risk mitigation
Risk transfer (Correct answer)
Risk acceptance

Correct answer: Risk transfer

Purchasing insurance is a form of risk transfer, shifting the financial consequences of a risk to a third party (the insurer) rather than bearing the full impact internally.

Question 18: In a DevOps environment, what is the purpose of a 'Runbook' from a governance and risk perspective?

To track individual employee performance metrics
To provide standardized, documented procedures for operational tasks, reducing human error and ensuring consistent responses (Correct answer)
To serve as a marketing document for DevOps capabilities
To replace the need for post-incident reviews

Correct answer: To provide standardized, documented procedures for operational tasks, reducing human error and ensuring consistent responses

Runbooks document step-by-step operational procedures, reducing risk from human error, ensuring consistency, and enabling faster recovery during incidents through repeatable processes.

Question 19: What does 'Continuous Compliance' mean in a DevOps context?

Performing compliance audits once per year at the end of the fiscal year
Automating compliance checks throughout the delivery pipeline so that adherence to policies is continuously verified (Correct answer)
Assigning a dedicated compliance officer to review every deployment manually
Documenting compliance activities only when an audit is scheduled

Correct answer: Automating compliance checks throughout the delivery pipeline so that adherence to policies is continuously verified

Continuous Compliance integrates automated policy checks into the CI/CD pipeline so that every change is validated against compliance requirements in real time, not just at audit time.

Question 20: A DevOps Leader identifies that a critical third-party API dependency has no SLA. Which risk response is most appropriate?

Accept the risk and continue as normal without documentation
Implement a fallback mechanism and negotiate an SLA with the vendor while documenting the residual risk (Correct answer)
Immediately discontinue use of the API in all environments
Transfer full responsibility for the risk to the development team

Correct answer: Implement a fallback mechanism and negotiate an SLA with the vendor while documenting the residual risk

The best response combines a technical mitigation (fallback) with a governance action (SLA negotiation) and proper risk documentation, balancing delivery continuity with risk management.

Question 21: Which DORA metric most directly signals elevated deployment risk in a DevOps team?

Deployment Frequency
Lead Time for Changes
Change Failure Rate (Correct answer)
Mean Time to Recovery

Correct answer: Change Failure Rate

Change Failure Rate measures the percentage of deployments that cause a failure in production, directly indicating how often changes introduce unacceptable risk to the system.

DOL Risk Management and Governance

Which risk management framework is most commonly integrated with DevOps practices to ensure continuous compliance and governance?

🃏 DOL Flashcards — Study This Quiz as Flip Cards →

📚 Want to go deeper? Read the Full DOL Study Guide →

What Practice Test Geeks adds beyond an AI chat for DOL

An AI chatbot can quiz you, but it can't reproduce the exam conditions or keep your record. Here you get:

A timed, full-length DOL mock exam — 40 questions in 60 minutes with a 65% pass mark, modeled on the official exam's question count and time limit, followed by a score report broken down by exam domain.
A fixed DOL question bank: the same test every attempt, so your score is comparable from one try to the next instead of changing with every regenerated quiz.
Progress saved on your device: completed tests, scores and missed questions stay in My Progress, so you can retake only what you got wrong.
A printable DOL cheat sheet you can print or save as a PDF.
DOL flashcards built from the same question bank.

Start the Timed DOL Mock Exam →

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

devopsinstitute.com — Score validity · verified Oct 2026
peoplecert.org — Test delivery, eligibility, fees, exam format, passing score, renewal, time limit · verified Oct 2026