312-97 EC-Council Certified DevSecOps Engineer (ECDE) Question and Answers

Azure Container Instances provide built-in logging capabilities that can be accessed using the Azure CLI. To retrieve logs from a deployed container instance, the correct command isaz container logsfollowed by the resource group and container name. The proper syntax requires double-dash parameters:--resource-groupand--name. In Erica’s case, the correct command is az container logs --resource-group ACI --name aci-test-closh. Options that use “az get container logs” are invalid because “get” is not a supported verb in this context. Option C uses incorrect single-dash flags, which do not match Azure CLI standards. Accessing container logs during the Code stage helps engineers validate application behavior, identify runtime errors, and ensure that security instrumentation such as RASP agents are functioning correctly before progressing further in the pipeline.

========

In an AWS CI/CD architecture, AWS CodePipeline acts as an orchestration service that coordinates different stages but does not execute build or scan commands itself. AWS CodeBuild is the service responsible for running commands such as compiling code, executing tests, and running third-party security tools like the Snyk CLI. In Terry’s workflow, CodeCommit stores the source code, EventBridge triggers the pipeline, and CodePipeline passes the source to CodeBuild. CodeBuild then executes the Snyk CLI, performs vulnerability scanning, and sends the scan results to the Snyk UI using the configured authentication token. AWS CodeDeploy is focused on application deployment and does not interact with Snyk CLI. Therefore, AWS CodeBuild is the component that interacts with Snyk CLI and communicates results back to the Snyk platform. This integration ensures that dependency vulnerabilities are detected early in the Build and Test stage.

========

Cloning a GitHub repository requires the standard Git command git clone followed by the correct repository URL format. GitHub repositories are structured as https://github.com/USERNAME/REPOSITORY.git, where USERNAME represents the account or organization name and REPOSITORY represents the project name. Option B follows this exact structure. Options using github clone are invalid because github is not a Git CLI command. Options that reverse the order of USERNAME and REPOSITORY do not match GitHub’s repository structure and will fail. Cloning repositories during the Code stage allows DevSecOps engineers to run static analysis, dependency scanning, and other security checks locally without modifying the original repository, supporting secure and controlled analysis workflows.

========

Git post-commit hooks are executed automatically after a commit is successfully created. To trigger the Jenkins build job configured to respond to commits, Alex must create a valid Git commit using the correct Git command. The standard command to commit changes with a message is git commit -m "commit from terminal". Running this command records the changes in the repository and triggers the post-commit hook, which in turn initiates the Jenkins build. Commands using github commit are invalid because github is not a native Git command-line utility. The -b flag is also not used with git commit. Automating build triggers during the Code stage improves efficiency, reduces manual intervention, and ensures continuous integration is consistently enforced.

========

Running an SSH service inside Docker containers is considered a security anti-pattern because it increases the attack surface and complicates key and access management. Containers are designed to run a single primary process and be managed externally rather than accessed via SSH. The recommended solution is torun SSH on the host systemand use docker exec to interact with containers when administrative access is required. This approach eliminates the need to manage SSH keys inside containers, reduces exposure to brute-force attacks, and simplifies access control. The other options incorrectly suggest running SSH in inappropriate locations such as the registry, client, or build process, which do not address the core security concern. During the Operate and Monitor stage, minimizing unnecessary services within containers is critical to enforcing least privilege and maintaining a secure runtime environment.

========

When changes are committed to a repository connected to an AWS Pipeline, the pipeline execution is triggered and monitored usingAmazon CloudWatch events. CloudWatch captures pipeline state changes, execution status, and approval notifications, enabling real-time monitoring and alerting. AWS Config tracks resource configuration changes, BinSkim is a binary analysis tool, and Security Hub aggregates security findings but does not directly track pipeline execution events. Integrating SonarQube into AWS Pipeline ensures static code analysis runs automatically upon commits, while CloudWatch provides visibility into pipeline activity. This setup strengthens security automation during the Code stage by ensuring every commit is analyzed and monitored.

========

GitLab CI/CD pipelines are defined using a configuration file namedgitlab-ci.yml, which must be placed in the root directory of the repository. This file controls pipeline stages, jobs, and template inclusions. To integrate Checkmarx SCA using a predefined template, the template reference must be included in the root-level gitlab-ci.yml file so GitLab can load and execute the defined jobs automatically. The other filenames listed in the options are not recognized by GitLab as valid pipeline configuration files. Integrating SCA at the Code stage allows early detection of vulnerable open-source dependencies, reducing remediation cost and preventing insecure components from progressing further in the DevSecOps pipeline.

Azure Container Instances (ACI) exposes container logs via the Azure CLI using the az container logs command. To retrieve logs, you must provide the resource group and the container group name using the long-form parameters --resource-group and --name. Option A matches the correct CLI structure and parameter format: az container logs --resource-group ACI --name aci-test-closh. Options B and D incorrectly use single-dash forms (-resource-group and -name), which are not valid for these long option names. Options C and D incorrectly use azure instead of az; the Azure CLI command group is invoked with az, not azure. Getting logs after deployment review is a critical Operate and Monitor activity: it helps confirm the container started correctly, diagnose runtime errors, and validate that runtime protection (such as a RASP/micro-agent) is functioning. This visibility supports faster incident response and helps ensure the containerized workload remains secure and stable in its runtime environment.

========

ThreatModeler’sAcceleratorcapability allows automatic generation of threat models directly from an organization’s live AWS environment. It connects to AWS services, analyzes deployed resources, and converts them into architectural diagrams and threat models without manual input. YAML-based orchestration tools and STRIDE per Element are methodologies used for modeling but do not automatically ingest live cloud configurations. Architect is a design construct, not an automation engine. Using Accelerator during the Plan stage enables proactive, continuous threat modeling, ensuring that evolving cloud infrastructure is always assessed for risk and security gaps.

========

Conjur policies define access controls, authentication rules, and secret variables, and they must be loaded into the correct policy branch. The conjur policy load command uses the -b flag to specify thepolicy branchand the -f flag to specify thepolicy file. To load a policy into the root branch, the correct command is conjur policy load -b root -f . Options that reverse or misuse these flags are invalid and would either fail or load the policy incorrectly. Loading policies correctly during the Build and Test stage ensures that Jenkins pipelines can securely access secrets at runtime, enforcing centralized secret management, least-privilege access, and compliance with security requirements.

========

w3af (Web Application Attack and Audit Framework) is aDynamic Application Security Testing (DAST)tool. It analyzes running web applications by sending crafted requests and observing responses to identify vulnerabilities such as SQL injection, cross-site scripting, and authentication flaws. Unlike SAST tools, w3af does not require access to source code and instead operates externally, simulating real-world attack behavior. SCA focuses on third-party dependencies, and IAST requires runtime instrumentation within the application. Since Debra detected vulnerabilities by actively interacting with the application, w3af clearly represents DAST. DAST tools are especially valuable during the Build and Test stage, as they validate application behavior from an attacker’s perspective before deployment.

========

Burp Suite’sOut-of-band Application Security Testing (OAST)feature is designed to detect vulnerabilities that do not produce immediate or visible responses during standard scanning. OAST works by triggering interactions such as DNS or HTTP callbacks, which occur outside the normal request-response cycle. This capability enables detection of blind vulnerabilities like blind SQL injection and server-side request forgery. Because findings are based on confirmed external interactions, OAST significantly reduces false positives. The other options listed are not valid Burp Suite features. Integrating OAST during the Build and Test stage improves the accuracy of dynamic security testing and ensures deeper coverage of complex and hard-to-detect vulnerability classes before applications are released.

========

The practices described—user identification and authorization, auditing, defense-in-depth, data protection, integrity enforcement, and input validation—are core elements that are planned and architected into the system from the beginning. These controls reflectSecure by Design, which focuses on embedding security principles at the design and architecture stage rather than adding them later. Secure by implementation emphasizes coding correctness, secure by default focuses on default configurations, and secure by communication focuses on trusted communication channels. DWART’s approach shows a holistic security mindset that anticipates attacker behavior and integrates layered defenses and controls into the system blueprint. This aligns directly with Secure by Design, which aims to reduce systemic risk by ensuring the application’s foundational structure enforces security consistently across all components and use cases.

========

To complete Azure Key Vault integration with Jenkins, Kevin must createnew credentialsin Jenkins underGlobal Credentials (unrestricted). These credentials store the Azure client ID, client secret, tenant ID, and subscription details required by the Azure Key Vault plugin to authenticate securely. Modifying old credentials can lead to misconfiguration or credential reuse risks, while restricted credentials may prevent the plugin from accessing secrets across pipelines. Creating new unrestricted credentials ensures proper authentication and controlled access to secrets during the Code stage, supporting secure secret management across CI/CD workflows.

To inspect mount propagation modes for Docker containers, Rockmond needs to list all container IDs and then inspect their configuration. The docker ps --quiet --all command outputs container IDs only, which are then passed to docker inspect using xargs. The --format option allows extraction of specific fields, such as mount propagation settings. Option C correctly uses valid flags (--quiet --all) and proper formatting syntax. Options A and D incorrectly use single hyphens, and option B omits the equals sign, which is required to display the propagation value. Inspecting mount propagation during the Operate and Monitor stage helps prevent unintended privilege escalation or data modification by other containers, aligning with container hardening best practices.

========

Ubuntu systems use the Advanced Package Tool (APT) for installing and managing software packages. The correct syntax for installing a package is sudo apt-get install . In this case, the OpenSSH server package required for secure remote access is named openssh-server, makingsudo apt-get install openssh-serverthe correct command. Options using apt.get are invalid because the command syntax is incorrect. Options that include the -s flag only simulate the installation process and do not actually install the package. Installing OpenSSH is often required when integrating Docker Bench with Jenkins, as it enables secure communication and remote execution of compliance checks. Performing this setup during the Build and Test stage ensures that container hosts comply with Docker CIS Benchmark recommendations, helping organizations identify misconfigurations and security weaknesses early in the pipeline.

========

Bundler-Audit is an SCA tool designed specifically for Ruby applications. It analyzes the Gemfile and Gemfile.lock to identify dependencies and checks them against known vulnerability databases. Bandit is intended for Python code analysis, Retire.js targets JavaScript libraries, and Tenable.io focuses on infrastructure-level vulnerabilities. By using Bundler-Audit during the Code stage, DevSecOps teams can detect vulnerable Ruby gems early and ensure that only secure dependencies are used. This reduces the risk of exploiting known vulnerabilities in third-party libraries and supports secure dependency management throughout the development lifecycle.

========

Ablameless post-mortemis conducted after a security incident to analyze what happened, why it happened, and how similar incidents can be prevented in the future—without assigning individual blame. The key indicators in the scenario are that the team identified the cause, resolved the issue, and documented lessons learned for future reference. Security acceptance tests and smoke tests are pre-release validation activities, while white-box testing focuses on code-level analysis rather than incident review. Blameless post-mortems are a cornerstone of DevSecOps culture, encouraging transparency, continuous learning, and systemic improvement during the Operate and Monitor stage.

========

Git hooks must have executable permissions to run automatically during Git operations such as commits. The standard way to make a file executable on Unix-like systems is by using the chmod command with the +x flag. In Elizabeth’s setup, the pre-commit hook is located in the ~/.git-templates/hooks/ directory, so the correct command is chmod a+x ~/.git-templates/hooks/pre-commit. The a+x option grants execute permission to all users, ensuring that the hook runs regardless of the user context. Options using +e are invalid because e is not a recognized permission flag. Ensuring that the hook is executable during the Code stage helps prevent accidental exposure of AWS credentials by enforcing security checks before commits are finalized.

Terraform infrastructure definitions are written in files with the .tf extension, commonly named main.tf. To create a new, empty file where infrastructure code can be added, the correct command is touch main.tf. This command creates the file without adding any content, allowing Scott to begin defining Docker infrastructure using Terraform syntax. The cat command is used to display file contents, not create files. The echo command prints text to standard output and does not create files unless output redirection is used. The command sudo main.tf is invalid and does not create files. Creating Terraform configuration files during the Release and Deploy stage supports Infrastructure as Code practices, enabling version control, repeatability, and security validation of infrastructure deployments. This approach allows DevSecOps teams to define, review, and deploy infrastructure in a consistent and auditable manner.

========

GitMiner is a Python-based tool, and like most Python projects, it manages its dependencies through a requirements file named requirements.txt. The correct way to install all dependencies listed in this file is by using the pip3 install -r requirements.txt command. The -r flag instructs pip to read package names and versions from the specified file and install them accordingly. The other flags shown in the options do not correspond to dependency installation from a requirements file and would result in command errors or unexpected behavior. Installing dependencies correctly is a prerequisite for running GitMiner successfully. During the Code stage, tools like GitMiner help identify hard-coded secrets and sensitive information early, reducing the risk of credential leakage and preventing security incidents later in the DevSecOps pipeline.

When configuring Burp Suite scans in Jenkins using an Execute shell build step, environment variables are often set or echoed so that subsequent scan steps can consume them. The echo command is used to output or define values in the shell context. In this case, echo BURP_SCAN_URL = http://target-website.com correctly defines the target URL for Burp Suite scanning. Commands like grep and cat are used for searching or displaying file contents and are not appropriate for setting scan parameters. The sudo command is unnecessary and incorrect in this context. Using the correct shell command ensures that Burp Suite receives the proper target information during the Build and Test stage, enabling accurate dynamic application security testing.

========

SonarLint is a static code analysis tool designed specifically to be used inside developers’ IDEs, where it provides immediate feedback while code is being written. It highlights bugs, security vulnerabilities, and code smells and, importantly, providesclear remediation guidancethat explains why an issue exists and how it can be fixed. This aligns directly with Debra’s requirement to fix issues “before they exist,” meaning before code is committed to the repository. Arachni and OWASP ZAP are dynamic application security testing tools that require a running application and are typically used later in the pipeline. Tenable.io is a vulnerability management platform focused on infrastructure and application scanning rather than real-time developer feedback. By using SonarLint, developers receive continuous guidance during coding, supporting the shift-left security approach in DevSecOps and reducing the cost and effort of fixing vulnerabilities later in the lifecycle.

========

AWS Inspector is a managed vulnerability assessment service designed specifically to scan workloads running on Amazon EC2 instances and container images for security vulnerabilities and unintended network exposures. It automatically evaluates instances against known vulnerabilities and security best practices, providing detailed findings and risk severity levels. AWS WAF protects web applications from common web exploits but does not perform host-based vulnerability scanning. AWS Config tracks configuration changes and compliance but does not actively scan workloads for vulnerabilities. Amazon CloudWatch focuses on monitoring logs, metrics, and alarms rather than security scanning. For a Spring Boot microservices application deployed on EC2, AWS Inspector is the correct choice to continuously assess security posture during the Build, Deploy, and Operate phases of the DevSecOps pipeline.

========

Syft is used by Anchore to generate Software Bill of Materials (SBOMs) from container images and directories. By default, Syft may only analyze the squashed image view. Using the --scope all-layers flag instructs Syft to include software components fromall image layers, ensuring comprehensive visibility into dependencies introduced at every stage of image creation. The other options use invalid syntax or unsupported flags. Including all layers during SBOM generation improves vulnerability detection accuracy and supports compliance requirements, making it a critical practice during the Build and Test stage.

To inspect exposed ports for running Docker containers, the recommended approach is to first retrieve container IDs using docker ps --quiet and then pass them to docker inspect. The --format option allows selective output of container configuration details, including port mappings. The command docker ps --quiet | xargs docker inspect --format ': Ports=' correctly extracts port information for each container. Options that include the --all flag or incorrect formatting are not valid for this inspection use case. Checking exposed ports is an important activity in the Operate and Monitor stage because unnecessary open ports increase the attack surface and may violate container security best practices. Regular inspection helps ensure that only required ports are exposed, supporting secure runtime operations.

========

GitGraber uses specific command-line flags to define how secret detection is performed. The -k flag is used to specify akeyword filethat contains search terms for identifying sensitive data in repositories. In this case, William wants to search for secrets using the keyword “yahoo,” which is passed using the -q flag. Options -w, -g, and -p are not valid flags for keyword-based scanning in GitGraber. By using -k, GitGraber scans repositories for matches against the defined keywords and reports potential secret exposures in real time. This capability is especially valuable during the Code stage, helping teams prevent credential leakage and maintain secure repositories.