DOL Risk Management and Governance 2

Question 1

What is 'Residual Risk' in the context of DevOps governance?

Accepted Answer

The risk that remains after controls and mitigation strategies have been applied

Answer

Residual risk is the remaining level of risk after all planned mitigation controls have been implemented, and it must be evaluated against the organization's risk tolerance.

Question 2

Which governance model is most aligned with the DevOps principle of decentralized decision-making?

Accepted Answer

Federated governance, where teams operate autonomously within centrally defined guardrails

Answer

Federated governance balances autonomy and control by empowering teams to move fast while adhering to organizational standards, aligning with DevOps values.

Question 3

What is the purpose of a Risk Register in a DevOps program?

Accepted Answer

To document identified risks, their likelihood, impact, owners, and mitigation actions

Answer

A Risk Register is a centralized document that captures all identified risks along with their attributes and mitigation plans, enabling ongoing risk monitoring and accountability.

Question 4

In DevOps, how does 'immutable infrastructure' contribute to risk reduction?

Accepted Answer

It eliminates configuration drift by replacing instances rather than modifying them, reducing unpredictable behavior

Answer

Immutable infrastructure reduces risk by ensuring that running systems are never patched in place but replaced with freshly built, tested instances, eliminating configuration drift.

Question 5

Which regulatory framework focuses specifically on protecting cardholder data and is relevant to DevOps teams handling payment systems?

Accepted Answer

PCI DSS

Answer

PCI DSS (Payment Card Industry Data Security Standard) governs how organizations handle, store, and transmit payment card data and directly impacts DevOps pipelines for financial applications.

(DOL) DevOps Leader Practice Test

(DOL) DevOps Leader Practice Test

DOL Risk Management and Governance 2