DOL Risk Management and Governance 2 — Questions and Answers
Question 1: What is 'Residual Risk' in the context of DevOps governance?
- Risk that has been fully eliminated by controls
- The risk that remains after controls and mitigation strategies have been applied (Correct answer)
- Risk transferred to a third-party vendor
- Risk identified but not yet assigned to an owner
Correct answer: The risk that remains after controls and mitigation strategies have been applied
Residual risk is the remaining level of risk after all planned mitigation controls have been implemented, and it must be evaluated against the organization's risk tolerance.
Question 2: Which governance model is most aligned with the DevOps principle of decentralized decision-making?
- Federated governance, where teams operate autonomously within centrally defined guardrails (Correct answer)
- Centralized governance, where all decisions go through a single approval committee
- Hierarchical governance, where senior management approves every deployment
- Vendor-driven governance, where tool vendors define compliance requirements
Correct answer: Federated governance, where teams operate autonomously within centrally defined guardrails
Federated governance balances autonomy and control by empowering teams to move fast while adhering to organizational standards, aligning with DevOps values.
Question 3: What is the purpose of a Risk Register in a DevOps program?
- To track the performance of individual developers
- To document identified risks, their likelihood, impact, owners, and mitigation actions (Correct answer)
- To store configuration management data for all environments
- To list all approved third-party software libraries
Correct answer: To document identified risks, their likelihood, impact, owners, and mitigation actions
A Risk Register is a centralized document that captures all identified risks along with their attributes and mitigation plans, enabling ongoing risk monitoring and accountability.
Question 4: In DevOps, how does 'immutable infrastructure' contribute to risk reduction?
- It prevents developers from making any code changes
- It eliminates configuration drift by replacing instances rather than modifying them, reducing unpredictable behavior (Correct answer)
- It locks down all network traffic between services
- It ensures all team members have identical development environments only
Correct answer: It eliminates configuration drift by replacing instances rather than modifying them, reducing unpredictable behavior
Immutable infrastructure reduces risk by ensuring that running systems are never patched in place but replaced with freshly built, tested instances, eliminating configuration drift.
Question 5: Which regulatory framework focuses specifically on protecting cardholder data and is relevant to DevOps teams handling payment systems?
- HIPAA
- SOX
- PCI DSS (Correct answer)
- GDPR
Correct answer: PCI DSS
PCI DSS (Payment Card Industry Data Security Standard) governs how organizations handle, store, and transmit payment card data and directly impacts DevOps pipelines for financial applications.
Question 6: What is a 'Chaos Engineering' experiment's primary role in risk management?
- To intentionally break production systems for entertainment
- To proactively identify weaknesses in system resilience by injecting failures in a controlled way (Correct answer)
- To test whether developers can work under stressful conditions
- To validate that backups are correctly configured after an incident
Correct answer: To proactively identify weaknesses in system resilience by injecting failures in a controlled way
Chaos Engineering proactively surfaces hidden risks by deliberately inducing failures in controlled environments, allowing teams to identify and fix weaknesses before they cause real outages.
Question 7: A DevOps Leader wants to ensure audit trails for all pipeline activities. Which practice best supports this governance requirement?
- Requiring developers to submit written reports after each deployment
- Implementing comprehensive logging, versioning, and traceability across all pipeline stages (Correct answer)
- Limiting access to production environments to senior staff only
- Conducting monthly manual audits of all deployment records
Correct answer: Implementing comprehensive logging, versioning, and traceability across all pipeline stages
Automated logging, version control, and end-to-end traceability create immutable audit trails that satisfy governance and compliance requirements without manual overhead.
DOL Risk Management and Governance 2
What is 'Residual Risk' in the context of DevOps governance?