312-97 EC-Council Certified DevSecOps Engineer (ECDE) Questions and Answers

Coverity is a well-known Static Application Security Testing (SAST) tool used to analyze source code for security vulnerabilities, coding errors, and quality issues. It integrates with CI/CD pipelines and supports enterprise-scale environments, including cloud-based development on platforms such as Azure. Accurics focuses on Infrastructure as Code security, Tenable.io is a vulnerability management platform for infrastructure and assets, and DevSkim is a lightweight code scanning extension rather than a full SAST platform. Selecting Coverity enables deep static analysis of application code during the Code stage, helping teams detect vulnerabilities early and reduce remediation costs.

========

To clone a repository from GitHub, the correct command is git clone followed by the accurate repository URL. The organization name continuumsecurity and repository name bdd-security must be spelled correctly for the command to succeed. Options using github clone are invalid because github is not a standard Git command-line utility. Options with misspelled organization names will result in errors. Cloning security testing frameworks during the Code stage enables DevSecOps engineers to evaluate, customize, and integrate security automation tools into development workflows, supporting secure application development and testing practices.

To inspect mount propagation modes for Docker containers, Rockmond needs to list all container IDs and then inspect their configuration. The docker ps --quiet --all command outputs container IDs only, which are then passed to docker inspect using xargs. The --format option allows extraction of specific fields, such as mount propagation settings. Option C correctly uses valid flags (--quiet --all) and proper formatting syntax. Options A and D incorrectly use single hyphens, and option B omits the equals sign, which is required to display the propagation value. Inspecting mount propagation during the Operate and Monitor stage helps prevent unintended privilege escalation or data modification by other containers, aligning with container hardening best practices.

========

In Go-based tool installation, the standard method to download, compile, and install a Go package is using the go get command followed by the repository import path. Since Matt has already ensured that Go version 1.8 or later is installed and that $GOPATH/bin is included in the system PATH, running go get github.com/michenriksen/gitrob will fetch the GitRob source code, build the binary, and place it in the appropriate bin directory. Options B, C, and D are invalid because go get does not accept multiple positional arguments in that manner, and go git is not a valid Go command. Installing GitRob during the Code stage enables DevSecOps teams to scan repositories for accidentally committed credentials, API keys, and other sensitive information, helping prevent data leakage from public repositories.

========

Prisma Cloud leveragesadvanced unsupervised machine learningto establish baselines of normal behavior within a customer’s cloud environment. By analyzing patterns in network traffic, resource interactions, and workload behavior without relying on labeled training data, it can detect anomalies and potential zero-day attacks with minimal false positives. Supervised approaches require predefined labels and known attack patterns, which limits effectiveness against new or unknown threats. Unsupervised data mining alone lacks the adaptive intelligence provided by machine learning models. Using unsupervised machine learning during the Build and Test stage enables continuous, intelligent security analysis across dynamic cloud-native workloads, supporting proactive threat detection in DevSecOps pipelines.

By default, Brakeman returns a non-zero exit code when security warnings are detected, which can cause Jenkins builds to fail. The --no-exit-on-warn option modifies this behavior by instructing Brakeman toreturn an exit code of 0 even if warnings are found. This allows the CI pipeline to continue executing while still generating a security report that highlights vulnerabilities. This option is particularly useful when teams are initially integrating SAST tools and want visibility into security issues without immediately blocking builds. During the Build and Test stage, this approach supports gradual adoption of security enforcement, allowing teams to prioritize remediation efforts while maintaining delivery velocity. Over time, organizations can tighten policies by removing this option to enforce stricter build-breaking behavior once security baselines improve.

ThreatPlaybook CLI is configured using the ThreatPlaybook configure command, which initializes the CLI with the required connection and user details. The -e option is used to specify the user’s email address, the -h option defines the host information such as IP address or hostname, and the -p option specifies the port number. This configuration enables the CLI to securely communicate with the ThreatPlaybook service for orchestrating threat modeling and application security testing workflows. Options that use playbook configure are incorrect because the executable name is explicitly ThreatPlaybook. Options using -u instead of -h do not correctly specify host information. Configuring ThreatPlaybook during the Plan stage helps teams adopt an attacker’s mindset early, embedding security into the organization’s culture and ensuring threats are identified and addressed before development and deployment activities begin.

========

Grype is a vulnerability scanning tool used to analyze container images and file systems for known vulnerabilities across operating system and application dependencies. The most effective way to perform a comprehensive scan is by running the grype --scope all-layers command. This ensures that vulnerabilities are detected acrossall layersof the container image, not just the final runtime layer. Containers often inherit vulnerabilities from base images or intermediate layers, making full-layer scanning essential. The packages subcommand is used for listing detected packages rather than performing vulnerability analysis. Running Grype during the Build and Test stage allows DevSecOps teams to identify vulnerable base images and dependencies early, reducing the risk of deploying insecure containers into production and supporting secure container lifecycle management.

========

When integrating security controls at the CDN edge with AWS CloudFront, the typical deployment model usesLambda@Edge, which allows code to execute at CloudFront edge locations on viewer request/response or origin request/response events. Deploying the tCell agent “as a CloudFormation stack” describes packaging the required AWS resources (IAM roles, functions, permissions, and CloudFront associations) into infrastructure-as-code, but the actual attachment point for CloudFront request/response processing is Lambda@Edge. Option C correctly reflects this: “plugging into CloudFront through Lambda@Edge.” Standard Lambda functions run in regional AWS environments and cannot directly run at CloudFront edge locations in the same way; therefore, “CloudFront through Lambda Function” is not the best match for edge enforcement needs like CSP handling and redirect protections. Options that claim “plugging into CloudFormation” misunderstand CloudFormation’s role: it deploys resources, but it is not the runtime integration point. Hence, CloudFront + Lambda@Edge is the correct deployment approach.

GitHub Code Scanning is a built-in security capability designed to automatically analyze source code for security vulnerabilities and coding errors. The primary and officially supported engine for GitHub Code Scanning isCodeQL. CodeQL works by converting source code into a database and running security queries to detect issues such as injection flaws, insecure coding patterns, and logic errors. William can enable CodeQL by configuring GitHub Actions with either the default or advanced CodeQL workflow. Once enabled, CodeQL scans are triggered on events such as code pushes and pull requests, and the results appear as code scanning alerts in the repository’s Security tab. Gauntlt is a security testing harness used mainly for infrastructure and application testing, GitMiner is used to discover sensitive data like secrets in repositories, and OWASP ZAP is a dynamic application security testing tool used against running applications. None of these tools configure GitHub’s native Code Scanning feature. Therefore, CodeQL is the correct tool to set up GitHub Code Scanning in the Code stage of a DevSecOps pipeline.

========

Kubernetes uses namespaces to logically isolate resources such as pods, services, and deployments. When an application like Jenkins is deployed into a specific namespace, the correct way to view the pods running in that namespace is by using the -n (or --namespace) flag with the kubectl get pods command. The command kubectl get pods -n jenkins instructs Kubernetes to list all pods in the “jenkins” namespace. The other options use invalid or unrelated flags that are not supported for namespace selection. Verifying pod status during the Release and Deploy stage is essential to ensure that applications have been deployed successfully and are running as expected before exposing services or proceeding to monitoring. This step supports deployment validation and operational readiness in Kubernetes-based DevSecOps environments.

AWS Inspector is a managed vulnerability assessment service designed specifically to scan workloads running on Amazon EC2 instances and container images for security vulnerabilities and unintended network exposures. It automatically evaluates instances against known vulnerabilities and security best practices, providing detailed findings and risk severity levels. AWS WAF protects web applications from common web exploits but does not perform host-based vulnerability scanning. AWS Config tracks configuration changes and compliance but does not actively scan workloads for vulnerabilities. Amazon CloudWatch focuses on monitoring logs, metrics, and alarms rather than security scanning. For a Spring Boot microservices application deployed on EC2, AWS Inspector is the correct choice to continuously assess security posture during the Build, Deploy, and Operate phases of the DevSecOps pipeline.

========

HashiCorp Vault provides a key-value (KV) secrets engine for securely storing sensitive data. To remove a secret from the KV store, the correct command is vault kv del . This command deletes the secret data at the specified path. Options using -delete or -del are syntactically incorrect, and vault kv delete is not a valid Vault CLI command. Proper secret deletion is an essential part of secret lifecycle management, especially when credentials may have been compromised. Performing this action during the Operate and Monitor stage helps contain security incidents, reduce exposure, and ensure that compromised secrets are no longer accessible. Timely deletion of secrets supports effective incident response and strengthens overall security posture.

========

Jenkins plugins are distributed and installed as .hpi files. To manually install a plugin, administrators upload the .hpi file through the Jenkins Plugin Manager using the “Upload Plugin” option. This approach is commonly used in environments with restricted internet access or when custom plugin versions are required. .war files are used for deploying the Jenkins application itself, not plugins, while .zip and .conf files are not recognized plugin formats. Installing the InsightAppSec plugin allows Jenkins pipelines to automatically trigger dynamic application security scans during the Build and Test stage. This integration ensures that web applications are continuously evaluated for vulnerabilities before deployment, supporting proactive security testing and risk reduction.

========

To inspect exposed ports for running Docker containers, the recommended approach is to first retrieve container IDs using docker ps --quiet and then pass them to docker inspect. The --format option allows selective output of container configuration details, including port mappings. The command docker ps --quiet | xargs docker inspect --format ': Ports=' correctly extracts port information for each container. Options that include the --all flag or incorrect formatting are not valid for this inspection use case. Checking exposed ports is an important activity in the Operate and Monitor stage because unnecessary open ports increase the attack surface and may violate container security best practices. Regular inspection helps ensure that only required ports are exposed, supporting secure runtime operations.

========

In a mature DevSecOps pipeline, security controls are enforced asgates, not merely as informational checks. When an SCA tool detects acritical vulnerabilityin a dependency—whether direct or transitive—the correct response at the Build and Test stage is tofail the build. This prevents vulnerable artifacts from moving forward into later stages such as deployment or production, where remediation would be more expensive and risky. Allowing the build to continue, even with notifications, contradicts the shift-left security principle. Ignoring transitive dependencies is also dangerous, as many real-world vulnerabilities originate from indirect libraries. Failing the build forces developers to remediate the issue immediately by upgrading, replacing, or mitigating the vulnerable dependency. This approach reduces attack surface, enforces accountability, and ensures that only secure artifacts are released. Therefore, stopping the pipeline upon detection of critical vulnerabilities reflects a strong DevSecOps maturity model and effective security governance.

Git hooks determine success or failure based on the exit code of the executed script. An exit code of0indicates successful execution, while any non-zero value signals failure and causes Git to abort the commit. In Jordon’s setup, a Bash shell calls a PowerShell script to perform pre-commit checks. If the PowerShell script exits with code 0, Git interprets this as a successful hook execution and allows the commit to proceed. Exit codes such as 1, 2, or 3 indicate errors or policy violations and will block the commit. This mechanism ensures that security or quality checks enforced by the pre-commit hook must pass before code is committed. Using exit codes in this way is a standard and reliable approach in cross-platform DevSecOps automation during the Code stage.

========

Burp Suite’sOut-of-band Application Security Testing (OAST)feature is designed to detect vulnerabilities that do not produce immediate or visible responses during standard scanning. OAST works by triggering interactions such as DNS or HTTP callbacks, which occur outside the normal request-response cycle. This capability enables detection of blind vulnerabilities like blind SQL injection and server-side request forgery. Because findings are based on confirmed external interactions, OAST significantly reduces false positives. The other options listed are not valid Burp Suite features. Integrating OAST during the Build and Test stage improves the accuracy of dynamic security testing and ensures deeper coverage of complex and hard-to-detect vulnerability classes before applications are released.

========

The BDD Security framework is executed through Gradle wrapper commands, and the correct wrapper script on Unix-like systems is ./gradlew (dot-slash indicates “run the wrapper from the current directory”). Options using /gradlew or /gradlev imply an absolute path at filesystem root and are typically incorrect for a cloned project. Also, the wrapper name isgradlew, notgradlev. For executing only the authentication feature (or scenarios tagged for authentication), Cucumber tag expressions are used through the -Dcucumber.options system property. The command must include --tags @authentication to select authentication-tagged scenarios. To skip scenarios tagged “skip,” the exclusion operator is used as --tags ~@skip (meaning “exclude @skip”). Options A and B incorrectly include --tags @skip which wouldincludeskipped tests rather than exclude them. Therefore, ./gradlew -Dcucumber.options="--tags @authentication --tags ~@skip" is the correct choice to run authentication scenarios while excluding anything marked to skip.

========

The Jscrambler configuration file .jscramblerrc is written inJSON format. JSON is widely used for configuration because it is lightweight, human-readable, and easily parsed by tools in CI/CD pipelines. Removing access and secret keys from this file is a recommended security practice to prevent credential leakage when the repository is shared or stored in version control. Instead, credentials are typically injected through environment variables or secure CI/CD secrets. XML, YAML, and HTML are not the formats used by Jscrambler for its primary configuration file. Using JSON-based configuration during the Code stage allows consistent integration with GitLab pipelines while maintaining secure handling of sensitive data.

========

To identify the currently running Java binary used by Jenkins, administrators typically inspect the running processes on the Linux system. The command ps -aux | grep Jenkins lists all active processes and filters those related to Jenkins. This output includes details such as the user, process ID, and the full command line used to start Jenkins, which often contains the path to the Java executable. The other options reference invalid or nonexistent commands (pc, as, ac). Locating the Java binary is necessary when installing certificates into the correct Java keystore, which is required for secure communication between Jenkins and tools like Acunetix. Performing this setup during the Build and Test stage ensures that DAST scans can run securely and reliably as part of automated pipelines.

========

Azure Container Instances provide built-in logging capabilities that can be accessed using the Azure CLI. To retrieve logs from a deployed container instance, the correct command isaz container logsfollowed by the resource group and container name. The proper syntax requires double-dash parameters:--resource-groupand--name. In Erica’s case, the correct command is az container logs --resource-group ACI --name aci-test-closh. Options that use “az get container logs” are invalid because “get” is not a supported verb in this context. Option C uses incorrect single-dash flags, which do not match Azure CLI standards. Accessing container logs during the Code stage helps engineers validate application behavior, identify runtime errors, and ensure that security instrumentation such as RASP agents are functioning correctly before progressing further in the pipeline.

========

Git post-commit hooks are executed automatically after a commit is successfully created. To trigger the Jenkins build job configured to respond to commits, Alex must create a valid Git commit using the correct Git command. The standard command to commit changes with a message is git commit -m "commit from terminal". Running this command records the changes in the repository and triggers the post-commit hook, which in turn initiates the Jenkins build. Commands using github commit are invalid because github is not a native Git command-line utility. The -b flag is also not used with git commit. Automating build triggers during the Code stage improves efficiency, reduces manual intervention, and ensures continuous integration is consistently enforced.

========

To identify the version of a service running on a target system, Nmap uses the -sV option, which enables service version detection. The -sS flag specifies a TCP SYN scan, which is a common and efficient scanning method. Combining these two flags allows Nmap to discover open ports and accurately identify the service versions running on those ports, such as Jenkins. Options A and B reference invalid scan types (-sJ) and do not enable version detection. Option C includes the correct flags but places them in a less conventional order; however, the commonly accepted and documented usage is -sV -sS. Running this scan during the Operate and Monitor stage helps security teams understand exposed services and assess potential attack surfaces.

========

Bitbucket provides a cloud-based source code management platform that supports collaboration, CI/CD integration, and secure code hosting. One of the key features offered by Bitbucket isfree unlimited private repositories, particularly beneficial for organizations developing proprietary software such as IoT applications. This allows teams to store source code securely without exposing it publicly while still enabling collaboration features like pull requests, issue tracking, and pipeline automation. The term “limited private repositories” is inaccurate because Bitbucket does not restrict the number of private repositories under its free offering; rather, user count limits apply. While Bitbucket also supports public repositories, the option that best represents its value to enterprise and product-based teams is unlimited private repositories. This capability aligns with DevSecOps practices by ensuring confidentiality of source code while enabling integrated planning, testing, and deployment workflows within a single platform.

========

CloudMapper requires read-only access to AWS resources in order to collect metadata, visualize architectures, and perform security analysis without modifying infrastructure. The AWS-managed policySecurityAuditprovides permissions to view security-related configuration across services, whileViewOnlyAccessallows read-only access to AWS resources more broadly. Together, these policies enable CloudMapper to gather comprehensive information about the AWS environment without granting write privileges. The other options either reference invalid policy names, incorrect formatting, or excessive permissions such as AWSLambdaFullAccess, which are unnecessary and violate least-privilege principles. Granting SecurityAudit and ViewOnlyAccess aligns with secure auditing practices during the Operate and Monitor stage.

========

HashiCorp Packer is an image automation tool that uses the packer build command to create machine images from configuration files written in HCL or JSON. When Robin defines her Docker image configuration in the file docker-ubuntu.pkr.hcl, the correct way to initiate the build process is by running packer build docker-ubuntu.pkr.hcl. This command reads the configuration file, initializes required plugins, executes defined builders and provisioners, and produces the final Docker image. The other options are syntactically incorrect because Packer does not support abbreviated flags such as -b or alternative verbs like -build. Building container images during the Build and Test stage ensures that images are reproducible, standardized, and compliant with organizational security requirements before deployment. Using Packer also supports immutability and reduces configuration drift, which are key principles in secure DevSecOps pipelines.

========