The timebox for the Sprint Review is four hours for a one-month Sprint, as stated in [4]: “The Sprint Review is held at the end of the Sprint to inspect the Increment and adapt the Product Backlog if needed. During the event, the Scrum Team and stakeholders review what was accomplished in the Sprint and what has changed in their environment. Based on this information, attendees collaborate on what to do next. The Product Owner explains what Product Backlog items have been “Done” and what has not been “Done”; additionally, they discuss any changes to scope or budget or potential value. The entire group then collaborates on what to do next, so that the Sprint Review provides valuable input to subsequent Sprint Planning. The Sprint Review is a working session and attendees should inspect based on facts. A Sprint Review is held at the end of every Sprint for a maximum duration of four hours for a one-month Sprint.”

Three statements that are true about Scrum are:

Each component of Scrum serves a specific purpose and is essential to Scrum’s success and your usage of Scrum to develop complex products.

Scrum is a framework for developing and sustaining complex products.

Scrum is based on empiricism and lean thinking.

These statements are supported by [6]: “Scrum is not a process, technique, or definitive method. Rather, it is a framework within which you can employ various processes and techniques. … Each component within the framework serves a specific purpose and is essential to Scrum’s success and usage. … The rules of Scrum bind together events, roles, artifacts, and rules governing their relationships. … The three pillars uphold every implementation of empirical process control: transparency, inspection, and adaptation.”

All of the above topics should be discussed in the Sprint Review, as stated in [4]: " The purpose of this meeting is to inspect what was delivered during this sprint and adapt what we want to deliver next. This means we will discuss three things:

What did we do this sprint?

How did we do it?

What do we want to do next? "

The correct answer is C, because if necessary, the Development Team is responsible for removing a team member who is creating a hostile environment. The Scrum Guide states that “development Teams are self-organizing. No one (not even the Scrum Master) tells the Development Team how to turn Product Backlog into Increments of potentially releasable functionality.” Therefore, the Development Team should manage its own composition and dynamics, and may need help from the Scrum Master to facilitate this process.

According to the Scrum Guide 1 , there is no such thing as a Release Sprint in Scrum. A Release Sprint implies that there are other Sprints that don’t produce a potentially releasable Increment, which violates the core principle of Scrum. Every Sprint should result in a “Done”, useable, and potentially releasable product Increment.

According to the Scrum Guide, an Increment does not have to be released to customers or users at the end of each Sprint. However, it must be in a usable condition and meet the Definition of Done. The decision to release an Increment is made by the Product Owner, based on the value and feedback obtained from stakeholders. The other option is not valid, as it implies that releasing an Increment is mandatory at the end of each Sprint.

The product has one Product Backlog, as it is a single source of requirements for any changes to be made to the product. There should be only one Product Owner, who is accountable for maximizing the value of the product and the work of the Development Team. Having multiple Product Owners or Product Backlogs would create confusion, inconsistency, and waste.

The correct answers are B and C because security is part of product quality and should be addressed within the Scrum Team’s ongoing work, not delegated away or deferred to a later phase. Option B is correct because security concerns can and should be made visible in the Product Backlog when there is specific work needed to address them. This ensures transparency and allows the team to inspect, prioritize, and act on those concerns as part of product development.

Option C is also correct because if security is necessary for an Increment to be complete and releasable, it belongs in the Definition of Done. This ensures that security expectations are consistently applied every Sprint rather than treated as optional or postponed.

Option A is incorrect because Scrum does not rely on handing responsibility to a separate department. Option D is incorrect because delaying security work undermines transparency and increases risk. Option E is incorrect because security should not be isolated into one future Sprint as a separate cleanup effort. Scrum promotes integrating quality, including security, continuously into development so each Increment is usable and meets appropriate standards.

 According to the Scrum Guide 1 , ordering Product Backlog items is solely up to the Product Owner’s discretion. The Product Owner orders items in the Product Backlog to best achieve goals and missions. To do this, they optimize value by considering various factors such as cost and benefit, risk, dependencies, date needed, etc. The Product Owner is responsible for maximizing the value of the work the Development Team does. The Scrum Master is accountable for establishing Scrum as defined in the Scrum Guide. They do this by helping everyone understand Scrum theory and practice, both within the Scrum Team and the organization. Therefore, an appropriate action for the Scrum Master to take if the Product Owner is struggling with ordering the Product Backlog is to offer the Product Owner help in understanding that the goal of ordering the Product Backlog is to maximize value.

According to the Scrum Guide 1 , the Daily Scrum is an event for the Developers of the Scrum Team. The purpose of the Daily Scrum is to inspect progress toward the Sprint Goal and adapt the Sprint Backlog as necessary, adjusting the upcoming planned work. The Scrum Master and Product Owner may attend as observers, but only if it is useful for the Developers.