ECCouncil EC-Council Certified DevSecOps Engineer (ECDE) - 312-97 Exam Practice Test

You are a DevOps Engineer at CloudNova, a technology firm that specializes in AI-powered SaaS applications. The company is migrating its development workflow to Google Cloud Platform (GCP) to improve software delivery speed and scalability. However, your team is facing multiple challenges such as manual build and deployment processes are slowing down the release cycle, developers frequently experience build inconsistencies and test failures due to lack of automation. To address these issues, you decide to implement a serverless CI/CD service that can automate builds, test code, and deploy software efficiently across various programming environments. Which GCP service should you use?

Kevin Williamson has been working as a DevSecOps engineer in an MNC company for the past 5 years. In January of 2017, his organization migrated all the applications and data from on-prem to AWS cloud due to the robust security feature and cost-effective services provided by Amazon.
His organization is using Amazon DevOps services to develop software products securely and quickly. To detect errors in the code and to catch bugs in the application code, Kevin integrated PHPStan into the AWS pipeline for static code analysis. What will happen if security issues are detected in the application code?

A DevSecOps team is working on an Azure DevOps project and wants to enhance security by configuring GitHub Advanced Security (GHAS). One of their primary concerns is the accidental exposure of sensitive information-such as API keys, credentials, and other confidential data-when developers push code to the repository. To mitigate this risk, the team is looking for a solution that can automatically detect and block sensitive information before it gets committed, ensuring that such data never reaches the repository. Which GHAS feature should the team enable to achieve this level of protection?

Nadia Correia works as a DevSecOps architect for a fintech startup in Lisbon. During the Plan stage of her pipeline, she wants to create a visual model that identifies potential threats, attack vectors, and trust boundaries in a new payments microservice before any code is written. Which activity should Nadia perform?

Ethan Ramirez, a security analyst at a tech startup in Austin, discovers that developers are accidentally committing API keys and passwords to the company's public Git repository. Concerned about the security risks, he decides to put measures in place to prevent sensitive information from being committed in the first place. Which approach will best help Ethan enforce this security control?

Robin, a DevSecOps Engineer, is responsible for ensuring that all developers in the organization use their corporate email addresses when committing code. To enforce this, Robin sets up a Git pre-commit hook on a Windows system. Since the team uses PowerShell, Robin decides to write a script to check the user's Git email configuration before allowing commits. After writing the script, Robin encounters an issue where the pre-commit hook is not executing properly. On investigation, Robin realizes that the script is not marked as executable. Which command should Robin run to ensure the pre-commit hook is executable?

Daniel, a DevSecOps engineer, is responsible for tracking and managing security risks and vulnerabilities in his organization's applications. To ensure an efficient workflow, he uses Jira to create security issues whenever a risk or vulnerability is detected. When a critical vulnerability is identified in the application, Daniel needs to determine whether the issue should follow a fix path, where the development team patches the code and revalidates it, or an accept risk path, where the issue is reviewed and deemed non-severe enough to proceed without a fix. Which approach should Daniel take if the vulnerability is critical and needs to be resolved before deployment?

Ethan Roberts, a DevSecOps engineer at SecureSoft Technologies, is responsible for securing software products and web applications throughout the development lifecycle. To enhance security testing, he implements Interactive Application Security Testing (IAST), which allows him to analyze source code for vulnerabilities in real-time, monitor security issues dynamically as the application runs, utilize IAST across the development, QA, and production stages to identify vulnerabilities early, and reduce remediation costs by detecting issues before deployment. Ethan's team is particularly interested in how IAST integrates both SAST and DAST capabilities. They observe that IAST can analyze every line of code statically (SAST) and examine every request and response dynamically (DAST). How does IAST achieve this dual functionality?

An enterprise healthcare application was recently targeted by a sophisticated attack. The attackers exploited misconfigured data flows and improperly secured API endpoints, exposing sensitive patient records. The DevSecOps team immediately deployed a tool to analyze the application's architecture by modeling its assets in a YAML file. This analysis revealed the exact vulnerabilities and provided detailed mitigation strategies, such as securing data flows with encryption and implementing stricter API access controls. The generated report helped the team resolve the issues swiftly and prevent future breaches. Which tool was likely used to handle this scenario?