DOL Risk Management and Governance 3

Question 1

Which of the following best describes the 'Three Lines of Defense' model as applied to DevOps governance?

Accepted Answer

Business operations, risk/compliance functions, and internal audit providing layered oversight

Answer

The Three Lines of Defense model assigns governance roles to operational management (1st line), risk and compliance functions (2nd line), and internal audit (3rd line) for layered assurance.

Question 2

What is the key difference between a 'vulnerability' and a 'threat' in risk management?

Accepted Answer

A vulnerability is a weakness that can be exploited, while a threat is a potential event that could exploit a vulnerability

Answer

A vulnerability is a weakness in the system, while a threat is a potential actor or event that could exploit that weakness to cause harm — both must be understood to assess risk.

Question 3

Which risk treatment strategy is being applied when an organization purchases cyber insurance for its DevOps operations?

Accepted Answer

Risk transfer

Answer

Purchasing insurance is a form of risk transfer, shifting the financial consequences of a risk to a third party (the insurer) rather than bearing the full impact internally.

Question 4

In a DevOps environment, what is the purpose of a 'Runbook' from a governance and risk perspective?

Accepted Answer

To provide standardized, documented procedures for operational tasks, reducing human error and ensuring consistent responses

Answer

Runbooks document step-by-step operational procedures, reducing risk from human error, ensuring consistency, and enabling faster recovery during incidents through repeatable processes.

Question 5

What does 'Continuous Compliance' mean in a DevOps context?

Accepted Answer

Automating compliance checks throughout the delivery pipeline so that adherence to policies is continuously verified

Answer

Continuous Compliance integrates automated policy checks into the CI/CD pipeline so that every change is validated against compliance requirements in real time, not just at audit time.

(DOL) DevOps Leader Practice Test

(DOL) DevOps Leader Practice Test

DOL Risk Management and Governance 3