DOL Risk Management and Governance 3

Question 1

Which of the following best describes the 'Three Lines of Defense' model as applied to DevOps governance?

Accepted Answer

Business operations, risk/compliance functions, and internal audit providing layered oversight

Answer

Development, Testing, and Production teams acting independently

Answer

Frontend, backend, and infrastructure teams sharing governance responsibilities

Answer

Planning, execution, and review phases of a sprint

Question 2

What is the key difference between a 'vulnerability' and a 'threat' in risk management?

Accepted Answer

A vulnerability is a weakness that can be exploited, while a threat is a potential event that could exploit a vulnerability

Answer

A vulnerability is external and a threat is internal

Answer

A vulnerability is a known issue and a threat is unknown

Answer

A vulnerability affects software only, while a threat affects infrastructure only

Question 3

Which risk treatment strategy is being applied when an organization purchases cyber insurance for its DevOps operations?

Accepted Answer

Risk transfer

Answer

Risk avoidance

Answer

Risk mitigation

Answer

Risk acceptance

Question 4

In a DevOps environment, what is the purpose of a 'Runbook' from a governance and risk perspective?

Accepted Answer

To provide standardized, documented procedures for operational tasks, reducing human error and ensuring consistent responses

Answer

To track individual employee performance metrics

Answer

To serve as a marketing document for DevOps capabilities

Answer

To replace the need for post-incident reviews

Question 5

What does 'Continuous Compliance' mean in a DevOps context?

Accepted Answer

Automating compliance checks throughout the delivery pipeline so that adherence to policies is continuously verified

Answer

Performing compliance audits once per year at the end of the fiscal year

Answer

Assigning a dedicated compliance officer to review every deployment manually

Answer

Documenting compliance activities only when an audit is scheduled

Question 6

A DevOps Leader identifies that a critical third-party API dependency has no SLA. Which risk response is most appropriate?

Accepted Answer

Implement a fallback mechanism and negotiate an SLA with the vendor while documenting the residual risk

Answer

Accept the risk and continue as normal without documentation

Answer

Immediately discontinue use of the API in all environments

Answer

Transfer full responsibility for the risk to the development team

Question 7

Which DORA metric most directly signals elevated deployment risk in a DevOps team?

Accepted Answer

Change Failure Rate

Answer

Deployment Frequency

Answer

Lead Time for Changes

Answer

Mean Time to Recovery