DOL Risk Management and Governance

Question 1

Which risk management framework is most commonly integrated with DevOps practices to ensure continuous compliance and governance?

Accepted Answer

NIST Risk Management Framework (RMF)

Answer

COSO ERM

Answer

Six Sigma DMAIC

Answer

PRINCE2

Question 2

In a DevOps context, what does 'risk appetite' refer to?

Accepted Answer

The level and type of risk an organization is willing to accept in pursuit of its objectives

Answer

The number of deployments an organization can handle per day

Answer

The budget allocated for disaster recovery planning

Answer

The tolerance for technical debt in a codebase

Question 3

What is the primary purpose of a Change Advisory Board (CAB) in an ITSM-integrated DevOps environment?

Accepted Answer

To assess risk and authorize changes to minimize disruption to services

Answer

To approve all code merges into the main branch

Answer

To manage the backlog of feature requests from stakeholders

Answer

To oversee the hiring and training of DevOps engineers

Question 4

Which approach best represents 'shifting governance left' in a DevOps pipeline?

Accepted Answer

Moving compliance checks and policy enforcement earlier into the development lifecycle

Answer

Delegating all governance responsibilities to development teams only

Answer

Applying governance reviews only at the production release stage

Answer

Removing governance controls to accelerate deployment speed

Question 5

A DevOps Leader is implementing Policy as Code. What is the primary benefit of this practice?

Accepted Answer

It enables automated, consistent enforcement of governance policies across all environments

Answer

It replaces the need for security audits entirely

Answer

It allows developers to bypass security reviews for faster delivery

Answer

It centralizes all policy decisions within the operations team

Question 6

In risk management, what is the difference between 'risk mitigation' and 'risk acceptance'?

Accepted Answer

Mitigation reduces the likelihood or impact of a risk, while acceptance acknowledges and tolerates a risk within defined thresholds

Answer

Mitigation eliminates risk entirely, while acceptance ignores it

Answer

Mitigation is proactive and acceptance is reactive

Answer

Mitigation is for technical risks only, while acceptance applies to business risks

Question 7

Which metric is most useful for measuring the effectiveness of risk management in a DevOps pipeline?

Accepted Answer

Mean Time to Detect (MTTD) and Mean Time to Recover (MTTR) from incidents

Answer

Lines of code written per sprint

Answer

Number of user stories completed per release

Answer

Total number of automated tests in the test suite