Answering: “At a Sprint Review meeting, the Product Owner introduces the functionality that is likely to be done over the next Sprints. The Chief Security Officer reminds everyone that through the envisioned functionality, sensitive personal user data will be stored. This might be the subject of external security audits. He reminds everyone of the important non-functional requirements with regards to security. These were not applicable and not considered previously.”

Fold the security expectations into the Definition of Done at the Sprint Retrospective, and add the related work to the Product Backlog to deliver alongside business functionality. Parallel security Sprints or a pause before new Sprints break Scrum’s steady flow of done Increments.

Exam Question

At a Sprint Review meeting, the Product Owner introduces the functionality that is likely to be done over the next Sprints. The Chief Security Officer reminds everyone that through the envisioned functionality, sensitive personal user data will be stored. This might be the subject of external security audits. He reminds everyone of the important non-functional requirements with regards to security. These were not applicable and not considered previously.
What are two good ways the Scrum Team can handle these high-security concerns? (choose the best two answers)

• A. They are discussed, determined, and documented in parallel Sprints to not disturb the actual feature development. Once analyzed, they should be applied to the work already done before further feature development can continue.
• B. They should be handled by a separate, specialist team in a parallel Sprint so they can be specifically resolved through an improved application design without hindering functional development.
• C. The impact of these security concerns on past AND future work needs to be determined before new Sprints can start. A list of security-related Product Backlog items needs to be passed on to the Product Owner before starting the next Sprint.
• D. During the Sprint Retrospective, the Scrum Team assesses how to add these expectations to the Definition of Done so every future Increment will live up to these requirements. If needed they can work with external specialists to better understand the requirements.
• E. They are added to the Product Backlog and addressed throughout the next Sprints, combined with creating the business functionality in those Sprints, no matter how small that business functionality.

Correct Answer

D and E.

Why This Is the Correct Answer

New non-functional requirements apply to every future Increment, so the Definition of Done is the right place for them. The Scrum Guide says the Retrospective inspects how the last Sprint went, including the Definition of Done, and that is where the team can strengthen it. External experts can help the team understand audit rules. Work to bring existing functionality up to the new standard, or to build security features, goes on the Product Backlog. The Product Owner orders it with other items, and the team delivers it with functional work every Sprint. That keeps each Increment usable and avoids separate teams or phases.

Why the Other Options Are Wrong

A. Handle security in parallel Sprints, then fix existing work before continuing. Parallel Sprints create a phase outside the team’s normal flow and delay value. Halting features until analysis ends is a waterfall approach.

B. Give security to a separate specialist team in parallel Sprints. A separate team creates hand-offs and leaves the Scrum Team without ownership of quality.

C. Assess all impact before any new Sprint and hand over a list. Sprints run back to back. Stopping to analyze everything up front is a big upfront phase, not Scrum.

Exam Tip

When new quality or compliance needs appear, look for two moves: update the Definition of Done and put the work on the Product Backlog. Reject parallel or pre-Sprint phases.

Key Takeaways

• New quality standards belong in the Definition of Done.
• Remediation work goes on the Product Backlog.
• Scrum avoids separate phases and specialist hand-offs.