DOL Risk Management and Governance 2

Question 1

What is 'Residual Risk' in the context of DevOps governance?

Accepted Answer

The risk that remains after controls and mitigation strategies have been applied

Answer

Risk that has been fully eliminated by controls

Answer

Risk transferred to a third-party vendor

Answer

Risk identified but not yet assigned to an owner

Question 2

Which governance model is most aligned with the DevOps principle of decentralized decision-making?

Accepted Answer

Federated governance, where teams operate autonomously within centrally defined guardrails

Answer

Centralized governance, where all decisions go through a single approval committee

Answer

Hierarchical governance, where senior management approves every deployment

Answer

Vendor-driven governance, where tool vendors define compliance requirements

Question 3

What is the purpose of a Risk Register in a DevOps program?

Accepted Answer

To document identified risks, their likelihood, impact, owners, and mitigation actions

Answer

To track the performance of individual developers

Answer

To store configuration management data for all environments

Answer

To list all approved third-party software libraries

Question 4

In DevOps, how does 'immutable infrastructure' contribute to risk reduction?

Accepted Answer

It eliminates configuration drift by replacing instances rather than modifying them, reducing unpredictable behavior

Answer

It prevents developers from making any code changes

Answer

It locks down all network traffic between services

Answer

It ensures all team members have identical development environments only

Question 5

Which regulatory framework focuses specifically on protecting cardholder data and is relevant to DevOps teams handling payment systems?

Accepted Answer

PCI DSS

Answer

HIPAA

Answer

SOX

Answer

GDPR

Question 6

What is a 'Chaos Engineering' experiment's primary role in risk management?

Accepted Answer

To proactively identify weaknesses in system resilience by injecting failures in a controlled way

Answer

To intentionally break production systems for entertainment

Answer

To test whether developers can work under stressful conditions

Answer

To validate that backups are correctly configured after an incident

Question 7

A DevOps Leader wants to ensure audit trails for all pipeline activities. Which practice best supports this governance requirement?

Accepted Answer

Implementing comprehensive logging, versioning, and traceability across all pipeline stages

Answer

Requiring developers to submit written reports after each deployment

Answer

Limiting access to production environments to senior staff only

Answer

Conducting monthly manual audits of all deployment records