Answering: “What are two effective ways for a Scrum Team to ensure security concerns are satisfied?”

Two good ways to handle security are to add security concerns to the Definition of Done and to create Product Backlog items for specific security work. Separate security Sprints or hand-offs to another department delay the problem.

Exam Question

What are two effective ways for a Scrum Team to ensure security concerns are satisfied?
(choose the best two answers)
A. Add a Sprint to specifically resolve all security concerns.
B. Have the Scrum Team create Product Backlog items for each concern.
C. Postpone the work until a specialist can perform a security audit and create a list of security-related Product Backlog items.
D. Delegate the work to the security department.
E. Add security concerns to the Definition of Done.

Correct Answer

B and E.

Why This Is the Correct Answer

Adding security standards to the Definition of Done means every Increment meets them, so security is built in rather than added later. Specific work such as a new encryption feature or fixing a known vulnerability goes on the Product Backlog, where it is visible and ordered like any other work. Both approaches keep security inside the Scrum Team’s normal flow, which fits the Scrum Guide’s idea that the team is cross-functional and has “all the skills necessary to create value each Sprint.”

Why the Other Options Are Wrong

A. Add a Sprint just to resolve security concerns. Every Sprint must produce a done, usable Increment. A dedicated security Sprint means earlier Increments were not really done.

C. Postpone work until a specialist audits and lists items. Waiting for an outside audit delays value and builds risk. Specialists can help, but the team should address security continuously.

D. Delegate the work to the security department. Handing off to another department breaks cross-functionality and creates queues. The Scrum Team stays accountable for a done Increment.

Exam Tip

Non-functional requirements like security, performance and compliance go into the Definition of Done or onto the Product Backlog, never into special Sprints or other departments.

Key Takeaways

• Security standards in the Definition of Done apply to every Increment.
• Specific security work is ordered on the Product Backlog.
• Special security Sprints and hand-offs are anti-patterns.