DOL Risk Management and Governance

Question 1

Which risk management framework is most commonly integrated with DevOps practices to ensure continuous compliance and governance?

Accepted Answer

NIST Risk Management Framework (RMF)

Answer

The NIST RMF provides a structured, flexible process for managing cybersecurity and operational risk that aligns naturally with DevOps continuous delivery cycles.

Question 2

In a DevOps context, what does 'risk appetite' refer to?

Accepted Answer

The level and type of risk an organization is willing to accept in pursuit of its objectives

Answer

Risk appetite defines how much risk an organization is willing to take on to achieve its strategic goals, guiding DevOps teams on deployment frequency and change thresholds.

Question 3

What is the primary purpose of a Change Advisory Board (CAB) in an ITSM-integrated DevOps environment?

Accepted Answer

To assess risk and authorize changes to minimize disruption to services

Answer

A CAB evaluates proposed changes for risk, impact, and urgency to ensure changes are authorized appropriately while minimizing service disruption.

Question 4

Which approach best represents 'shifting governance left' in a DevOps pipeline?

Accepted Answer

Moving compliance checks and policy enforcement earlier into the development lifecycle

Answer

Shifting governance left embeds compliance checks, policy validation, and risk controls early in the pipeline (e.g., at code commit) rather than at the end, reducing costly late-stage failures.

Question 5

A DevOps Leader is implementing Policy as Code. What is the primary benefit of this practice?

Accepted Answer

It enables automated, consistent enforcement of governance policies across all environments

Answer

Policy as Code automates governance by encoding rules in version-controlled scripts, enabling consistent, repeatable enforcement at scale without manual intervention.

(DOL) DevOps Leader Practice Test

(DOL) DevOps Leader Practice Test

DOL Risk Management and Governance