Answering: “A Developer takes the Scrum Master aside to express his concerns about data security issues. What should the Scrum Master do?” (PSM I)

The Scrum Master should encourage the Developer to raise the security concern with the team as soon as possible. The team, not the Scrum Master, decides how to deal with it.

Exam Question

A Developer takes the Scrum Master aside to express his concerns about data security issues. What should the Scrum Master do? (choose the best answer)

• A. Go check with the testers.
• B. Create a Product Backlog item for security.
• C. Tell the Product Owner to stop further development of features until the issues are fixed.
• D. Ask the Developer to share the concern with the team as soon as possible.
• E. Add security to the Definition of Done.

Correct Answer

D. Ask the Developer to share the concern with the team as soon as possible.

Why This Is the Correct Answer

Scrum depends on transparency, and the Scrum Value of openness asks people to be open about challenges. A security risk known by one person and the Scrum Master is hidden from everyone who could act on it. The Scrum Master’s job is not to fix the problem personally but to coach team members toward self-management. Bringing the concern to the Scrum Team lets the Developers and the Product Owner decide together whether it needs a Product Backlog item, a change to the Definition of Done or something else. Doing it quickly matters because security issues tend to get more expensive the longer they wait.

Why the Other Options Are Wrong

A. Go check with the testers. Scrum has no separate tester role, and this keeps the issue away from the whole team. The Scrum Master would be investigating instead of enabling.

B. Create a Product Backlog item for security. This might be the right outcome, but the Scrum Master should not decide it alone. The Product Owner manages the Product Backlog.

C. Tell the Product Owner to stop feature development. The Scrum Master does not direct the Product Owner. Halting work is a drastic step before anyone has assessed the risk.

E. Add security to the Definition of Done. The Scrum Team owns the Definition of Done. One person cannot change it on the basis of a private conversation.

Exam Tip

When a team member brings a problem privately to the Scrum Master, the best answer usually makes it transparent to the team. Answers where the Scrum Master solves it alone are traps.

Key Takeaways

• Concerns should be made visible to the whole Scrum Team.
• The Scrum Master enables decisions but does not make them.
• Openness is a Scrum Value, not just a nice habit.