312-97 EC-Council Certified DevSecOps Engineer (ECDE) Exam Free Dumps

dumps2025-10-14T09:28:18+08:00

312-97 exam is one for EC-Council Certified DevSecOps Engineer (ECDE) certification. Learning 312-97 exam basic information is a required step in your preparation. There are 100 multiple-choice questions in real EC-Council 312-97 exam, and you have 4 hours to answer all the questions. The required passing score is 70%. We provide the latest EC-Council Certified DevSecOps Engineer (ECDE) 312-97 exam dumps, which can ensure you pass the test easily. Free EC-Council Certified DevSecOps Engineer (ECDE) 312-97 exam dumps are available below.

Page 1 of 15

1. Scenario: You are tasked with reviewing the security posture of a project that uses multiple open-source libraries.

What is the first step you should take to assess the security risks of these libraries?

Perform an automated vulnerability scan of the libraries.

Run static code analysis on the libraries’ source code.

Rely on community feedback and star ratings to assess library security.

Review the open-source licenses to ensure compliance.

2. During a compliance audit, it was found that several environments do not meet HIPAA’s requirements for secure data storage.

What should be the next step to ensure compliance across the development pipeline?

Restrict compliance checks to the production environment only to ensure smooth operation.

Implement end-to-end encryption for all environments handling sensitive data.

Perform post-deployment reviews once per quarter to identify and address compliance gaps.

Delay compliance checks until the final pre-production stage to minimize delays.

3. Scenario: Your organization is developing a web-based application that will handle sensitive data.

How can you ensure that security is incorporated into the design and development phases?

Focus on end-user security awareness training during the rollout phase.

Rely on manual code reviews to ensure secure coding practices.

Schedule a security audit once the application is near completion.

Integrate static code analysis and threat modeling into the early stages of development.

4. During the development of a cloud-based application, which practice should a team adopt to ensure comprehensive threat modeling?

Conducting a manual review of security controls once per development sprint.

Integrating automated threat modeling tools into the CI/CD pipeline for continuous threat assessment.

Having quarterly third-party security audits to validate the threat model's effectiveness.

Hosting monthly security workshops to discuss and update the threat model with new findings.

5. What is a common security issue in traditional DevOps workflows that involves inadequate handling of security alerts?

Inadequate monitoring of network traffic to detect anomalous activities that could indicate a breach.

Overlooking the encryption of sensitive data at rest and in transit within the CI/CD pipeline.

Not enforcing strong access control measures on production servers and development environments.

Failing to prioritize and address high-severity security alerts in a timely manner.

6. You are tasked with using Puppet to deploy and manage a new application across multiple servers.

What is the first step you should take to ensure the application deployment meets security and compliance requirements?

Run a Puppet parser validate on your manifests to check for syntax errors.

Define the node configuration in the site.pp file to assign specific classes to the servers.

Import existing infrastructure configurations using Terraform to manage the Puppet code.

Update the Hiera data with the new application's configuration parameters before deployment.

7. Which control should be implemented to ensure compliance with GDPR in a DevSecOps environment when managing user data across multiple systems?

Implementing strong passwords for all user accounts accessing personal data.

Limiting access to personal data through a centralized authentication service.

Using manual reviews to ensure data access logs are regularly checked.

Enforcing encryption of personal data at rest and in transit.

8. When establishing risk thresholds in a DevOps environment, what type of analysis is crucial for early identification of potential security flaws?

Dynamic Application Security Testing (DAST)

Manual Code Review

Static Application Security Testing (SAST)

Interactive Application Security Testing (IAST)

9. In a scenario where a software release pipeline is being designed, which integration would be most effective for early detection and remediation of security vulnerabilities?

Adding real-time threat detection systems during the deployment stage to monitor and react to issues immediately.

Configuring manual security reviews to be conducted by the QA team before any code is pushed to production.

Setting up periodic security audits by an external agency at the end of every release cycle.

Implementing automated security scans during the continuous integration process to ensure each integration is checked.

10. Fill in the blank: To automate vulnerability scans in a DevSecOps pipeline, integrating _____ with Jenkins ensures that known security issues are continuously checked for in each build.

Regular penetration testing

Open-source vulnerability databases

Manual security code reviews

Quarterly security audits

Page 2 of 15

11. You are tasked with implementing branch protection rules in GitHub to secure your main branch.

What should be the initial setting to enforce for contributors?

Enforce a linear commit history on the main branch

Enable email notifications for commits to the main branch

Require pull requests before merging

Mandate a specific number of code reviewers for each pull request

12. Fill in the blank: Using __________ in the initial design phase helps identify security threats that could

impact system components.

threat modeling tools

system component analysis

security requirement specifications

security audits

13. When establishing a culture of shared responsibility, which tool should be configured to automatically enforce security policies during the development phase?

GitHub Actions without specific security workflows

Jenkins with generic pipeline scripts

Docker with default security profiles

SonarQube with project-specific quality gates

14. During a sprint review, the DevOps team presents a new feature update.

What would be the best question to ask to ensure security considerations have been addressed?

Was a threat modeling session conducted for the changes made in this sprint?

How quickly can we roll back this update if needed?

What is the impact on the existing user base?

Have we updated the system documentation to reflect these changes?

15. Fill in the blank: To foster a collaborative security culture, it's crucial that ___________ policies are communicated clearly and integrated seamlessly into the CI/CD pipeline.

user feedback and review

documentation and usage

security and compliance

operational and performance

16. Fill in the blank: To automatically enforce security scans on every push in GitHub, you should configure ________ workflows in the repository settings.

GitHub Actions

GitHub CodeQL

GitHub Issue Templates

GitHub Security Bot

17. Fill in the blank: In Security by Design, developers should follow the ________ principle to limit the privileges granted to users and processes.

defense in depth

least privilege

multi-factor authentication

zero trust

18. Fill in the blank: To effectively manage security risks in DevOps, it is essential to implement continuous

________ monitoring.

performance

threat

integrity

compliance

19. A DevOps team is revising their pipeline to include security measures.

What is the best practice for ensuring code deployed to production is secure?

Requiring that all code changes pass automated security tests in the staging environment before being deployed to production.

Implementing mandatory code reviews and pair programming in the development phase to ensure code quality.

Using feature flags to selectively enable new features in production for testing under real conditions without broader risk.

Conducting bi-monthly security drills involving all personnel to ensure readiness for potential security breaches.

20. Which tool is most effective for automated security scanning in the code commit phase of DevSecOps?

Configuring Fail2Ban to block IPs that show suspicious behavior on the development servers.

Deploying Snort as an IDS to monitor network traffic for malicious activity during development.

Using GitGuardian to automatically scan for secrets and sensitive data in code commits.

Installing Wireshark to analyze and log data packets as part of the DevSecOps monitoring stage.

Page 3 of 15

21. What is the most effective way to incorporate security into Agile sprints without slowing down the development cycle?

Use automated security tools that run alongside other continuous integration tools.

Rely solely on external penetration tests conducted after the product is deployed.

Use a separate team for security reviews that only gets involved after major releases.

Separate security testing from the development team and handle it post-deployment.

22. When evaluating open-source libraries for security risks, what should you prioritize to ensure safe integration into your DevOps environment?

Verify the number of contributors to assess the library’s reliability.

Analyze the documentation for ease of integration and usage.

Evaluate the library’s performance benchmarks in various environments.

Check the security advisories and reported vulnerabilities of the library.

23. What command in Ansible allows you to securely encrypt sensitive data in your playbooks, which is crucial for maintaining security in Infrastructure as Code (IaC) deployments?

ansible-vault rekey

ansible-galaxy install -r requirements.yml

ansible-vault encrypt

ansible-playbook --syntax-check

24. In a DevSecOps environment, which command would best enable continuous integration tools to perform static code analysis checks automatically before merging code branches?

git merge --no-ff feature-branch

chmod +x deploy.sh

ssh-add -l

git hook --pre-push "npm run test && npm run scan"

25. During a CI/CD pipeline review, you notice that security scans are run post-deployment.

What is a more effective strategy to enhance the security of the pipeline?

Run security scans only after deployment to ensure no runtime issues are present.

Conducting security scans only once at the end of each month as a comprehensive measure.

Implement security scans at both the pre-commit and pre-deployment stages.

Moving security scans to the testing stage only, bypassing earlier opportunities.

26. Which approach should be used in Bamboo to ensure that every code commit automatically triggers a security scan without manual intervention?

Run manual security scans after each significant code change is reviewed.

Execute security scans only after the integration of all major features.

Assign security testing as a separate phase once the development is complete.

Configure triggers that launch security scans upon every commit in the repository.

27. Fill in the blank: In Agile development, implementing _____ helps ensure that security vulnerabilities are addressed as soon as they are detected within the sprint cycle.

Continuous security assessments

Quarterly external security audits

Weekly manual code reviews

Perform static code analysis before product launch.

28. Given a scenario where a DevSecOps team needs to choose a tool for continuous security monitoring, which tool would be best suited for real-time threat detection?

Using a tool like Splunk for its robust capabilities in processing and alerting on security events in real time.

Implementing Google Cloud Security Command Center for its integration with cloud services and scalability.

Utilizing an endpoint protection platform like Symantec for device-level security monitoring and management.

Adopting an open-source tool such as Ossec for log-based intrusion detection across distributed systems.

29. How can you prevent sensitive data from being pushed to a remote repository in Git?

Regularly rotate SSH keys used for accessing the repository.

Configure a pre-push hook that scans for sensitive data.

Encrypt sensitive data files using Git-crypt before pushing.

Use a .gitignore file to avoid tracking files containing secrets.

30. What tool should be integrated into the CI/CD pipeline to automatically assess and manage security risks in code?

Fortify on Demand

Nexus Lifecycle

Black Duck

OWASP Dependency Check

Page 4 of 15

31. What is the primary benefit of integrating security practices throughout the DevSecOps lifecycle?

Strengthening the collaboration between operation teams and developers for faster feature releases.

Accelerating the detection and resolution of security issues while reducing the cost of fixes.

Increasing the overall efficiency of the software development process by automating deployments.

Enhancing the transparency and traceability of code changes and security policies.

32. Scenario: Your team is integrating a new third-party service that handles sensitive data.

What is the best initial step to manage potential security risks?

Obtain compliance certification for the third-party service.

Review the service-level agreements (SLAs) for security clauses.

Update the internal coding guidelines to include third-party interactions.

Conduct a security risk assessment of the third-party service.

33. Scenario: You are setting up a CI/CD pipeline for a new web application. The first step is to ensure code quality and security from the start.

What action should you take to automate this process?

Implement peer code reviews for each commit to the repository.

Set up ESLint in the development environment to check for coding errors.

Configure SonarQube in the pipeline to perform static code analysis.

Use manual code review sessions before merging to main branch.

34. What is the primary security risk when configuring a webhook in a CI/CD pipeline that triggers deployments automatically upon code commits?

Not limiting webhook triggers to specific IP addresses or trusted domains.

Failing to secure the server where the CI/CD pipeline is hosted, allowing external access.

Using basic authentication without encryption for the webhook UR

Using webhooks that do not verify the source IP address of the incoming HTTP requests.

35. During Agile development, which stage should security reviews be integrated into to ensure secure coding practices are followed continuously?

Perform security checks only at the beginning of the project before any development.

Conduct security reviews at each iteration during the development cycle.

Delay security reviews until the final sprint to focus on feature completion.

Postpone security reviews until post-deployment to avoid delaying feature releases.

36. Fill in the blank: HIPAA requires that all systems managing Protected Health Information (PHI) must implement _____ to prevent unauthorized access to sensitive data during development and operations.

Conduct regular penetration tests

Manual security audits

Encryption on-demand

Strong access control policies

37. Scenario: Your organization relies heavily on open-source components.

What practice should be implemented to ensure these components remain secure over time?

Perform penetration testing on open-source components every six months.

Rely on manual code reviews for third-party libraries once a year.

Implement an automated tool to monitor for open-source vulnerabilities continuously.

Track issues in the project's issue tracker to gauge the library’s health.

38. Fill in the blank: In a security-as-code approach, integrating _____ into the infrastructure code ensures

that misconfigurations are automatically detected and remediated before deployment.

Quarterly security audits

Policy-as-code tools

External code analysis

Manual security reviews

39. A developer configures a new service in the CI/CD pipeline that compiles code and runs tests.

What should be the security focus to ensure the integrity of the build process?

Enforcing that the build server uses signed scripts and validated tools only.

Restricting access to the build server to a limited number of IP addresses.

Implementing manual reviews of all scripts used by the build process.

Ensuring all output from the build process is logged and monitored for suspicious activity.

40. In a DevSecOps scenario, you are deploying a network application using Terraform. The configuration specifies firewall rules. Identify the incorrect Terraform command that could potentially expose the application to security risks.

terraform apply -auto-approve

terraform destroy -auto-approve

terraform refresh

terraform plan -out=tfplan

Page 5 of 15

41. Which command would set up a security linter to automatically review code in a Git pre-commit hook?

cp security-linter-hook .git/hooks/pre-commit && chmod +x .git/hooks/pre-commit

echo "./security-linter" > .git/hooks/pre-commit && chmod +x .git/hooks/pre-commit

git config --global core.hooksPath .githooks && echo "run-security-linter" > .githooks/pre-commit

npm install --save-dev security-linter && npm run precommit

42. Fill in the blank: To secure a CI/CD pipeline, it is essential to implement _____ to check for secret keys

and credentials unintentionally committed to the version control system.

Integration testing

Automated scanners

Periodic audits

Manual code reviews

43. Fill in the blank: DevSecOps aims to ensure security by embedding it into the ________ pipeline.

deployment

delivery

continuous integration

development

44. In a CI/CD pipeline, what would be the optimal placement for conducting static code analysis to maximize security benefits?

At the very start of the pipeline, before any code is integrated or tested.

After every commit to individual developer branches, prior to integration.

After the code is merged to the main branch but before any testing is performed.

Just before the deployment stage to catch vulnerabilities before the code is deployed.

45. Fill in the blank: To foster a culture of collaboration between development and security, it is essential that both teams participate in ___________.

shared code repositories

security forums

cross-functional teams

joint training sessions

46. A DevOps team realizes their application is often exposed to risk due to outdated dependencies.

What would be the best approach to automate the detection and management of such vulnerabilities?

Employing manual code reviews at the end of each sprint to check for any security vulnerabilities related to outdated dependencies.

Requiring developers to manually update their project dependencies every quarter as part of the release process.

Setting up a quarterly review of all project dependencies by the internal security team to ensure they are up-to-date.

Integrating a real-time dependency scanning tool into the version control system to automatically flag outdated or vulnerable libraries.

47. When implementing shift-left security, which step should a development team take to integrate security tools into the early stages of the development pipeline?

Implement static code analysis during the pre-commit phase using automated tools.

Perform security testing after code deployment to the production environment to reduce delays.

Delay the security review until after the testing phase to minimize disruption to development.

Rely on manual security reviews only during the final integration stage.

48. In a project kickoff meeting, a DevSecOps team discusses the integration of automated security testing.

Which approach would best ensure that the testing is both effective and efficient?

Organizing weekly security audits conducted by the internal security team to assess vulnerabilities.

Integrating a suite of automated testing tools that include static code analysis, dynamic analysis, and dependency checking at multiple stages.

Employing manual penetration testing at the final stage of the development lifecycle to ensure security.

Setting up a schedule for quarterly external security assessments to complement the internal security measures.

49. In a DevOps pipeline, which Docker command is crucial to ensure that only trusted images are used in the build process?

docker build --pull

docker image verify --trusted

docker run --secure

docker pull --verify

50. Scenario: In an advanced CI/CD setup, you're tasked with implementing a system that prevents deploying code with known vulnerabilities.

Which integration should be prioritized in your pipeline configuration?

Integrate Snyk for real-time vulnerability scanning.

Add a manual approval step before the deployment stage.

Deploy a gateway that filters out traffic to vulnerable services.

Utilize a post-deployment script to revert changes if vulnerabilities are found.

Page 6 of 15

51. You are tasked with setting up automated security compliance checks for a project in Bamboo.

What would be the most effective strategy to integrate security tools without disrupting the workflow of the development team?

Implement third-party security audits for compliance checks at the final stage of production.

Embed security checks into the Bamboo pipeline at the build phase for seamless automation.

Run automated tests only after deployment to avoid disrupting development.

Run compliance tests manually once the build is complete to avoid overloading the pipeline.

52. What is the best command to integrate open-source dependency scanning into a CI/CD pipeline for early detection of vulnerabilities?

npm outdated --global

npm audit --fix

npm cache clean --force

npm install --audit

53. During a code review, a shift-left security policy mandates that all code commits must pass security tests.

How should the team automate this process to avoid manual intervention without introducing delays to the deployment pipeline?

Schedule security testing as a separate process outside of the main development cycle.

Configure the CI/CD pipeline to automatically block code commits that fail security scans.

Run static analysis only at the end of the sprint to prevent delays during development.

Perform security checks manually after all development is complete to avoid disrupting the pipeline.

54. A company is processing personal data from EU citizens in their DevSecOps workflow.

What would be the most effective strategy to maintain GDPR compliance while keeping development speed high?

Periodically updating data classification based on sensitivity.

Use data anonymization for personal data during the entire lifecycle.

Rely on external audits to ensure compliance with GDP

Outsource compliance management to a third-party consultancy.

55. A team is using shift-left security principles and wants to ensure that all code undergoes static analysis before it is pushed to the shared repository.

How should this be automated to ensure early detection of vulnerabilities?

Schedule weekly security reviews to scan for vulnerabilities in the final codebase.

Apply post-deployment security testing to catch any remaining vulnerabilities.

Set up a pre-commit hook to automatically run static code analysis before pushing changes.

Use manual security reviews after each feature is completed to ensure compliance.

56. At which stage of the DevOps pipeline should security be integrated to review and enforce coding standards?

Including security training for developers during the planning phase to mitigate risks associated with coding.

Integrating security at the code commit stage using pre-commit hooks and static code analysis tools.

Applying security practices during the deployment phase to ensure all configurations are secure before release.

Enforcing security measures in the monitoring phase to respond to and mitigate detected vulnerabilities post-deployment.

57. When using infrastructure-as-code (IaC), which approach ensures security policies are consistently enforced across multiple environments in a DevSecOps pipeline?

Use external security scanning tools post-deployment to identify misconfigurations.

Define security policies in code and enforce them through automated CI/CD pipeline checks.

Perform manual security audits after each deployment is complete to ensure compliance.

Ensure that security policies are reviewed separately from the codebase in a dedicated phase.

58. During an Agile retrospective, the team identifies that their current process overlooks critical security assessments.

What would be the most effective strategy to address this gap in the next sprint?

Assign one developer per sprint to manage all security aspects independently.

Integrate a dedicated security story into each sprint alongside regular features.

Postpone security reviews until post-release to avoid impacting sprint velocity.

Incorporate monthly security reviews as a separate phase outside the sprint cycle.

59. A development team is following Agile methodology and is planning for a two-week sprint.

What should be the focus to integrate security in this sprint without delaying deliverables?

Running security scans after all sprints are completed to save time.

Regularly performing security-focused code reviews at each commit.

Add a dedicated security testing phase between the development and production stages.

Limiting security integration to the design phase and skipping it in sprints.

60. Scenario: You are tasked with enhancing risk management practices in your DevOps team.

What strategy should be prioritized to align risk management with ongoing operations?

Schedule regular risk assessment meetings with project stakeholders.

Introduce a mandatory code review process for all new integrations.

Establish automated security scanning within the CI/CD pipeline.

Implement periodic security training for the DevOps team.

Page 7 of 15

61. Fill in the blank: In traditional DevOps workflows, the lack of _________ between security tools and deployment processes often leads to vulnerabilities.

integration

collaboration

automation

communication

62. How do you generate a threat model report in Threat Dragon to document identified risks?

Click on the "Report" tab, select "Generate Report", then save the PDF output.

Access the "Tools" menu, select "Export", and choose the "XML" format for integration.

Run threatdragon --export --format=pdf --output=report.pdf from the command line.

Select "File", then "Save As", and choose the format you want to export to (e.g., JSON).

63. Fill in the blank: Shift-left security encourages development teams to adopt _____ to continuously detect security issues during the coding phase rather than waiting until later in the SDLC.

Manual code audits

Annual external security audits

Monthly penetration tests

Continuous code scanning

64. Considering the need to track and manage security issues that arise during testing, which tool should a DevSecOps team use for effective issue tracking and resolution?

Implementing Asana for task management with a focus on prioritizing security tasks based on risk.

Adopting Trello and integrating it with Slack for real-time security alerts and issue tracking.

Utilizing Jira with custom security workflows and automated alerting configurations.

Leveraging Basecamp to manage project tasks and highlight security issues flagged during development.

65. When integrating a security tool into a CI/CD pipeline, which command correctly configures a static code analysis tool to run automatically after each commit?

sca-tool --init && sca-tool --commit-check

npm install --save-dev sca-tool && npm run sca

./configure --enable-sca && make && make test

git commit -m "Add SCA" && ./run-sca.sh

66. What command integrates a security scanning tool into a Jenkins pipeline to automatically execute after every build?

jenkins-job-builder update /path/to/job-configs

curl -X POST http://jenkins:port/job/job-name/build --data token=TOKEN

jenkins-cli -s http://server:port create-job job-name < /path/to/config.xml

git push origin master && jenkins-cli start-build job-name

67. Fill in the blank: Integrating automated security testing in the ________ stage of the DevOps pipeline helps detect vulnerabilities early.

build

deployment

testing

integration

68. During a DevSecOps pipeline review, what is the most critical security measure to ensure ISO 27001 compliance in automated deployments?

Perform compliance checks only at the end of the development cycle.

Only running security tests in production environments after deployment.

Implementing automated configuration management with security baselines.

Implementing security measures only during the final testing phase.

69. Given a Chef recipe intended to enforce HTTPS on a web server, which attribute must be set to true to ensure all HTTP traffic is redirected to HTTPS?

default['http']['force_https'] = true

default['https']['use_ssl'] = true

default['nginx']['redirect_http_to_https'] = false

default['http']['ssl_redirect'] = true

70. In a scenario where a development team is tasked with building a financial application, which practice should they implement first to align security with business objectives?

Implementing an agile methodology that emphasizes rapid deployment over security considerations.

Conducting a risk assessment meeting to identify potential security threats and compliance requirements.

Beginning the project with a focus on user experience design before considering security implications.

Setting up an initial project meeting to discuss the technology stack and architecture only.

Page 8 of 15

71. In a scenario where the DevSecOps team is working on implementing automated security checks, which configuration ensures that these checks are mandatory before deployment?

Configuring the development environment to prevent merging code that fails security checks.

Enforcing that all code commits pass a peer security review before being considered for integration.

Set the deployment pipeline to halt if any critical security warnings are raised by the automated checks.

Using a system of badges to gamify security, awarding developers for secure coding practices.

72. Fill in the blank: For a secure CI/CD pipeline, it's essential to use ________ to manage and scan for

vulnerabilities in your container images.

Red Hat Quay Security Scanner

Google Container Registry Vulnerability Scanning

Docker Trusted Registry (DTR)

Kubernetes Cluster Security Scanner

73. In a scenario where a team is integrating a new payment system, which threat modeling approach should be used to identify potential security flaws?

Applying the STRIDE methodology to systematically analyze the potential threats to data integrity and confidentiality.

Implementing fault tree analysis to identify single points of failure in the payment processing workflow.

Conducting a risk matrix evaluation to prioritize risks based on their likelihood and impact.

Using attack tree analysis to focus on the various ways the payment system can be compromised.

74. When automating security testing in a Jenkins pipeline, which step would be most efficient to integrate static analysis tools to identify vulnerabilities early in the development process?

Schedule static analysis as a post-build action in the pipeline.

Add the security static analysis as a pre-build step before code compilation.

Perform security tests after each production deployment to verify vulnerabilities.

Set the security scan to execute at the deployment phase of the pipeline.

75. When setting up a secure CI/CD pipeline in GitLab, what is the first step to ensure that only authorized code changes are deployed to production environments?

Integrate a third-party code analysis tool for additional security checks.

Implement automated testing of code changes in the CI/CD pipeline.

Apply static and dynamic analysis tools during the build process.

Set up role-based access control (RBAC) for branch merges.

76. How would you configure SonarQube to run security scans on new code submissions automatically?

sonar-scanner -Dsonar.qualitygate.wait=true

wget http://downloads.sonarqube.org/sonarqube-8.2.zip && unzip sonarqube-8.2.zip

docker run -d --name sonarqube -p 9000:9000 sonarqube

sonar-scanner -Dsonar.projectKey=my_project -Dsonar.sources=. - Dsonar.host.url=http://mysonarqube:9000

77. Scenario: You are designing a new microservices architecture. To ensure security from the start, what action should be taken to protect communication between services?

Isolate each service in a separate container to limit lateral movement.

Encrypt the data storage layer to ensure confidentiality.

Implement mutual TLS authentication between the services.

Set up firewalls for each service with default-deny rules.

78. Fill in the blank: ___________ should be conducted early to define clear security requirements and expected controls for each phase of development.

Compliance checks

Security audits

Threat modeling

Penetration testing

79. What is the best method to enforce security controls during the early design phase of a software project in a DevSecOps environment?

Introduce a penetration testing phase during the final release.

Apply security threat modeling during the system architecture design.

Conduct a vulnerability assessment before deployment to production.

Perform continuous integration with automated security scanning.

80. In a detailed scenario, a DevOps team frequently encounters delays in their release cycle due to last-minute security assessments.

Which strategy would best address this bottleneck?

Developing a comprehensive security training program for all DevOps personnel to improve security practices.

Creating a dedicated security team that only focuses on reviewing code before it goes into production.

Scheduling monthly security audits by an external consultant to identify and resolve potential security issues.

Implementing automated security scanning tools early in the CI/CD pipeline to ensure that vulnerabilities are identified and addressed promptly.

Page 9 of 15

81. In GitLab, which feature allows you to enforce that all commits must be reviewed by another team member before they are merged into a protected branch?

Commit Signing with GPG keys

Access Control Lists (ACL)

Branch Protection Rules

Merge Request Approvals

82. A team is deploying a new service.

What is the best way to ensure that security is integrated into the automated deployment scripts?

Restrict access to deployment scripts to senior developers only

Update the service discovery tooling configurations only

Include mandatory security checks and conditional approval gates in the scripts

Manually review each deployment script during team meetings

83. Which approach can be used to automate security checks in the development process without delaying the team’s progress when practicing shift-left security?

Run security scans manually on completed features at the end of the sprint cycle.

Assign security testing as a separate task in the final phase of development.

Incorporate security checks as part of automated unit tests that run with each commit.

Integrate security checks only after the code has been merged into the main branch.

84. What command would you use to integrate a security scanner into a Jenkins pipeline script to perform automated code analysis?

jenkins.addScanner('sonarQube')

jenkins.setIntegration('fortifyScan')

jenkins.triggerSecurity('checkmarx')

jenkins.deployPlugin('aquaSecurity')

85. During an infrastructure deployment using Ansible, what step should be taken to ensure security-as-code practices are applied and validated without slowing down the deployment process?

Embed security policies directly into the Ansible playbooks and enforce validation during deployment.

Run compliance checks post-deployment, validating that all resources follow the security policies.

Perform security policy checks only at the end of each deployment process to avoid delays.

Validate the infrastructure security using manual scripts post-deployment to ensure accuracy.

86. Fill in the blank: To manage risks in open-source dependencies, developers should regularly check for ________ updates that patch known vulnerabilities.

compatibility

functional

security

license

87. Fill in the blank: __________ is essential for managing security policies and ensuring compliance in DevSecOps toolchains.

Kubernetes Secrets

Puppet Enterprise

Chef Compliance

Ansible Tower

88. In infrastructure design, which configuration should be prioritized to ensure that security is integrated by default when deploying virtual machines in a cloud environment?

Use role-based access controls (RBAC) to manage permissions.

Configure autoscaling groups to limit exposure in case of failure.

Enable secure baseline configurations using infrastructure as code (IaC).

Use a centralized security group to manage access control policies.

89. Fill in the blank: In Puppet, to manage system configurations and ensure compliance, you would use the ________ resource type.

file

package

exec

service

90. What is the most effective way to automate security policy validation as part of the code review process in a GitOps workflow?

Only implement security policy validation at the end of the development cycle.

Schedule security policy validation manually during the final review stage.

Create automated tests that run security policies against infrastructure code changes in pull requests.

Delay the security review until after the infrastructure has been deployed.

Page 10 of 15

91. In a scenario where a team needs to integrate vulnerability assessment tools into their CI/CD pipeline, which tool would best automate this process?

Applying Clair for Docker image scanning in a CircleCI workflow.

Setting up OpenVAS with a script that triggers scans post-build in TeamCity.

Integrating Nessus into the Jenkins pipeline using the Nessus Jenkins plugin.

Using Qualys VM within a GitLab CI environment to perform scheduled vulnerability scans.

92. Which tool is best suited for creating and sharing interactive threat models within a DevSecOps team?

OWASP ZAP for dynamically scanning web applications during development.

Threat Dragon for its collaborative diagramming and threat rule automation features.

ThreatModeler for its ability to automatically apply its comprehensive threat library.

Microsoft Threat Modeling Tool for its integration with Windows-based development environments.

93. Which command effectively audits existing Docker container configurations to identify security misconfigurations?

docker inspect --format '{{ .NetworkSettings.IPAddress }}' container_id

docker container inspect --format '{{ .Config.Env }}' $(docker ps -q)

docker ps --format 'table {{.Names}} {{.Status}}'

docker network ls --format '{{ .Name }}: {{ .Driver }}'

94. Which of the following describes a secure coding guideline that should be implemented in a DevSecOps environment to enhance the collaboration between development and security teams?

Implementing mandatory use of a standardized set of development tools across all projects.

Requiring all developers to attend a weekly meeting where security practices are discussed.

Enforcing peer review of code before it is merged into the main branch to catch security issues early.

Setting clear policies for security incident reporting within the DevOps team.

95. A development team uses Jenkins for continuous integration and wants to automate security checks for each code commit.

What should be the focus to ensure security scans are automated without slowing down the development process?

Incorporate lightweight static analysis tools at the pre-build phase for faster results.

Integrate deep penetration testing tools into the post-build stage to identify security issues.

Use penetration testing tools that run after each deployment to the production environment.

Schedule security scans after each sprint is completed for final verification.

96. Consider a scenario where a new developer joins a DevSecOps team.

Which practice best ensures that the developer integrates well into the existing culture of security and collaboration?

Implementing a buddy system where the new developer pairs with a security specialist for the first few projects.

Establishing a mandatory introductory course on security best practices that every new team member must complete.

Organizing monthly meet-ups where developers can present on security topics they are passionate about.

Requiring new developers to complete a series of security challenges that simulate real-world scenarios.

97. How can you ensure that user stories include security requirements from the beginning of a project?

Including security tasks as part of the definition of done for the project management phases.

Add a "Security" acceptance criterion to each user story during the sprint planning meeting.

Mandating that security be addressed only in the final phases of the project.

Requiring that all developers attend a security workshop before the project starts.

98. What tool can be used at the project initiation phase to ensure that security requirements are effectively communicated and tracked?

Utilizing Google Docs to maintain a live document of evolving security needs.

Adopting Slack for real-time communication on security updates and alerts.

Using Microsoft Teams to discuss security needs and updates during daily stand-ups.

Implementing Atlassian Confluence to create a collaborative space for documenting security requirements.

99. A team is using Terraform to deploy infrastructure in a multi-cloud environment.

How should security policies be integrated to ensure compliance with organizational standards across all resources?

Conduct a review of the Terraform code for security vulnerabilities after deployment.

Rely on manual code inspections to verify compliance with security policies.

Apply security policies only after resources have been provisioned in the cloud environment.

Include a policy-as-code module that validates configurations before applying changes.

100. When setting up a new software project, which approach should a project manager take to ensure security is considered throughout the project lifecycle?

Establishing a security governance framework that includes regular security reviews and stakeholder meetings.

Organizing a training session on the latest security tools and practices for the development team.

Waiting to consider security measures until after the first phase of development is completed to see if the project is viable.

Integrating security testing tools into the CI/CD pipeline from the start without a prior review of requirements.

Page 11 of 15

101. When configuring Snyk for continuous monitoring of a project, which file is essential to define the project-specific settings?

.snyk policy file to store policy settings and ignore certain vulnerabilities.

config.yaml to configure integration with different development tools.

package.json to specify dependencies for node.js projects.

.gitignore file to specify what project files and directories should be ignored by git.

102. A team is setting up an automated pipeline in Azure DevOps for a .NET application.

Which step is essential for integrating security testing?

steps: - script: dotnet build - script: dotnet sonarscan begin /k:"project-key" /d:sonar.host.url="http://your-sonar-instance"

steps: - task: Maven@3 - inputs: mavenPomFile: 'pom.xml' - script: mvn org.owasp:dependency-check-maven:check

steps: - task: MSBuild@1 - inputs: solution: '**/*.sln' - task: VSTest@2 testAssemblyVer2: '**/*test*.dll'

steps: - task: NuGetToolInstaller@1 - script: nuget restore - script: dotnet test

103. What command is used to initiate an automated scan with OWASP ZAP against a target URL, including all associated pages?

zap-cli api-scan --format openapi --url 'http://example.com/api'

zap-cli start --start-options '-config api.disablekey=true' && zap-cli open-url 'http://example.com' && zap-cli active-scan -r http://example.com

zap-cli quick-scan --self-contained --url 'http://example.com'

zap-cli spider --recursive 'http://example.com'

104. A security engineer is configuring a database system to protect sensitive customer information. The engineer must implement encryption at rest with periodic key rotation.

What configuration should be applied to ensure strong data protection while complying with industry standards?

Use MD5 hashing for database records and rotate keys manually every five years.

Use triple DES (3DES) encryption with manual key rotation and hardware key storage.

Use RSA-2048 encryption for data storage and key rotation every 365 days.

Use AES-256 encryption with automatic key rotation managed by a hardware security module (HSM).

105. A development team is tasked with implementing a single sign-on (SSO) solution for a cloud application. They need to ensure secure authentication using federated identity management, without storing passwords.

What configuration should be used to integrate a third-party identity provider?

Use SAML to integrate third-party identity providers with single sign-on and secure authentication across cloud services.

Use password synchronization between the cloud provider and local systems to manage authentication for single sign-on.

Use OAuth2 with manual user credential storage in the local application for added control over the authentication process.

Implement biometric authentication and store encrypted passwords within the cloud application for enhanced authentication security.

106. Fill in the blank: In an IAST configuration, the security team must ensure that the __________ is capable

of handling real-time analysis and reporting.

load balancer

central monitoring dashboard

security policy manager

application performance manager

107. In a serverless architecture, what is the primary security benefit of segregating sensitive operations into dedicated Lambda functions?

It allows for more granular logging and monitoring of actions performed by different functions.

This approach minimizes the attack surface by isolating sensitive operations, which reduces the potential impact of security breaches.

Dedicated functions can leverage AWS’s built-in security features like AWS Shield for enhanced protection.

It simplifies the codebase by consolidating multiple operations into single, multi-purpose functions.

108. When configuring rate limits on API endpoints to mitigate DoS attacks, which of the following strategies ensures optimal performance while preventing misuse?

Using a server-wide fixed threshold for all users, with no differentiation based on individual usage patterns.

Setting a global timeout for all API requests to limit the processing time and reduce the risk of overload.

Applying a user-specific and IP-specific request cap that adjusts based on typical user behavior.

wget --header="Authorization: Bearer $(echo -n username | base64)" https://api.example.com/data

109. Fill in the blank: To comply with data privacy regulations such as GDPR, personal data in transit must be encrypted using secure protocols like ____ to prevent unauthorized access.

Internet Protocol Security (IPSec) tunneling.

Hypertext Transfer Protocol Secure (HTTPS) version 1.1.

Secure Shell (SSH) protocol version 2.

Transport Layer Security (TLS) version 1.3.

110. Fill in the blank: To prevent unauthorized access to data in transit, the best practice is to use ____ to encrypt data transmitted between applications over a network.

Transport Layer Security (TLS) version 1.3.

Internet Protocol Security (IPsec) tunneling.

Secure Shell (SSH) version 2.

Datagram Transport Layer Security (DTLS) version 1.2.

Page 12 of 15

111. A DevSecOps engineer plans to integrate OWASP ZAP with their CI/CD pipeline.

Which setup would ensure that ZAP properly scans pull requests before merging?

Utilizing the ZAP Docker container to initiate scans triggered by pull request events in the CI/CD pipeline.

Implementing a gateway step in the pipeline that halts all builds until ZAP scans are manually approved.

Using a scheduled nightly build to perform scans irrespective of code changes or pull requests.

Configuring a manual trigger within the CI/CD pipeline that requires developer input to start the ZAP scan.

112. In a simulated environment, an application developer implemented an input validation function. However, they reported unexpected crashes when certain inputs were processed. Analyze the scenario and identify the potential cause.

The input data is being validated against an outdated or incorrect regular expression pattern.

The crash is due to a misconfiguration in the application’s exception handling routines, not related to input validation.

The input validation function may lack proper error handling and boundary checks, causing buffer overflow.

There might be an infinite loop in the validation logic, consuming all available memory resources.

113. A DevOps team needs to update their CI/CD pipeline to integrate with Vault for secrets management.

What is a crucial first step they should take to secure API keys?

Implement a manual process where developers must request access to Vault via IT support each time.

Set up an automated script to regularly rotate API keys and update them in Vault without policy constraints.

Directly embed Vault's API key into the CI/CD pipeline script for quick integration and setup.

Configure Vault policies that restrict access based on minimum necessary privileges and roles.

114. What command would you use in Docker to securely pass secrets to a running container without leaving traces on the filesystem?

docker run --name app-container -v /path/to/secrets:/secrets:ro myapp

docker run --name app --secret source=api_key,target=/run/secrets/api_key,readonly myapp

docker create --name secure-app -e API_KEY=$(cat /tmp/apikey) myapp

docker exec -it app echo "export API_KEY=your_api_key_here" > /root/.bashrc

115. In a Jenkins pipeline, how should you securely handle API keys to avoid hardcoding them into the Jenkinsfile?

def apiKey = 'hardcoded-api-key'; echo "Using API key: $apiKey"

parameters { string(name: 'API_KEY', defaultValue: 'your-key') } // globally accessible

environment { API_KEY = 'insert-your-api-key-here' } // in pipeline script

withCredentials([string(credentialsId: 'api-key-id', variable: 'API_KEY')]) { // use $API_KEY }

116. Fill in the blank: To mitigate cross-site scripting (XSS) through input validation, it is essential to sanitize user inputs, especially in fields that accept HTML content. One effective method is to use _____ to encode input before it is rendered in the browser.

Base64 encoding.

URL parameter encoding.

HTML character entity encoding.

JavaScript Object Notation (JSON) encoding.

117. In mobile DevSecOps, what command should be used to encrypt sensitive data before storing it in a shared preferences file on Android?

openssl rsa -in private.pem -outform PEM -pubout -out public.pem

openssl enc -aes-256-cbc -salt -in plaintextfile -out encryptedfile.key -k password

gpg --symmetric --cipher-algo AES256 plaintextfile

mcrypt -u -a rijndael-256 -m ecb -k passKey

118. A security team is tasked with enhancing API security.

What command correctly implements an HMAC-based authorization header for API requests?

ssh -i api_key.pem [email protected] "cat /var/log/api_access.log"

curl -H "Authorization: hmac username,nonce,signature" https://api.example.com/data

openssl dgst -sha256 -hmac "secretkey" -out digest.txt data_to_protect.txt

curl -H "Authorization: hmac username,nonce,signature" https://api.example.com/data

119. During the deployment of an application that stores sensitive data, which configuration should be used to enable encryption at rest using AWS S3 bucket encryption?

Enable server-side encryption with customer-provided keys (SSE-C) for the S3 bucket.

Enable S3 object encryption using a custom-built encryption algorithm stored in the application layer.

Apply server-side encryption using AES-256 keys managed by AWS KMS for the S3 bucket.

Enable encryption using MD5 hash functions with no specific key rotation plan for S3 data.

120. A security team is tasked with improving password management across an organization. They need to implement a policy that forces users to reset their passwords every 90 days while ensuring that old passwords cannot be reused.

What steps should they take to configure the password management system?

Force users to change their passwords annually and allow the reuse of old passwords if they are reset through a password recovery mechanism.

Enforce password rotation every 90 days, implement password history to prevent reuse, and require a minimum complexity level for new passwords to include special characters, numbers, and uppercase letters.

Allow password reuse after three password changes and enforce a password expiration policy every 120 days with optional password complexity.

Set no expiration for passwords but require users to reset their passwords manually after a security incident.

Page 13 of 15

121. You are configuring a Terraform setup for AWS.

What is the best practice for managing AWS access and secret keys securely?

Encrypt AWS keys using third-party tools before uploading them to the Terraform cloud workspace.

Embed AWS keys in a public GitHub repository but restrict access to known IPs.

Store AWS keys in plain text in the Terraform script for ease of use across multiple modules.

Use the AWS provider's assume_role functionality to dynamically assume roles based on permissions.

122. Fill in the blank: To ensure integrity in the CI/CD pipeline, always enable __________ in GitHub to require status checks before merging.

mandatory checks

branch protection

merge approval

commit signatures

123. Considering automated vulnerability scanning within GitHub Actions, what is the best method to initiate a Probely scan every time a push to master is made?

trigger: push: branches: ['master'] action: scan with: probelyScanAction@v1 on: ubuntu-latest

on: push: branches: - master jobs: build: runs-on: ubuntu-latest steps: - name: Run Probely Scan uses: probely/probely-scan-action@v1 with: apiKey: ${{ secrets.PROBELY_API_KEY }} targetId: ${{ secrets.TARGET_ID }}

jobs: - name: Security job: if: github.event_name == 'push' && github.ref == 'refs/heads/master' uses: actions/probely@v1

on: release: types: [published] jobs: security_scan: runs-on: ubuntu-latest steps: - name: Execute Probely Scan run: probely_scan.sh

124. What security measure should be implemented in the CI/CD pipeline to automatically check for outdated libraries in a mobile app's codebase?

gradle dependencyCheck --configuration compile

npm audit --production

yarn check --integrity

owaspDependencyCheck --projectName MyMobileApp --scan ./path/to/app

125. In GitLab CI, what is the purpose of protecting a branch and how is it configured to safeguard the CI/CD pipeline?

Configure automatic expiration of old builds and purge logs after 30 days to reduce risk of data leaks.

Enact a workflow where changes can only be committed to the main branch by senior team members, using a manual review process.

Set up branch restrictions to automatically delete branches after the pull requests are merged to protect against stale data.

Enable branch protection rules, requiring merge requests to be reviewed by at least two maintainers before merging.

126. You are tasked with designing a secure CI/CD pipeline for a new project.

What strategy would be most effective for detecting configuration drift in the pipeline infrastructure?

Use monitoring tools to check for unauthorized access or alterations to the CI/CD environment in real-time.

Set up anomaly detection systems that notify administrators of unexpected changes in pipeline activity or resource usage.

Implement infrastructure as code (IaC) with automatic drift detection tools that alert and auto-correct discrepancies.

Regular manual reviews of the pipeline setup and scripts to ensure no unauthorized changes have been made.

127. Fill in the blank: To adhere to best practices for secure code development, it's vital to use __________ to manage and rotate secrets within application environments securely.

plaintext configuration files

environment variables

encryption algorithms

hard-coded passwords

128. Fill in the blank: In a microservices architecture, OAuth2 is typically used for authentication, while ____ is used for authorization to control which users can access specific resources.

Access Control Lists (ACLs).

OAuth2 Authorization Code Flow.

JSON Web Token (JWT).

Role-Based Access Control (RBAC).

129. When storing user passwords in a web application, what method should be used to ensure secure password storage and protect against brute-force attacks or credential theft?

Store passwords in plaintext but protect them with database encryption to avoid direct exposure of passwords.

Encrypt passwords using AES-256 before storing them in the database to ensure that passwords remain confidential even if the database is compromised.

Store passwords using MD5 hashing without salting and save the hashed password in a database to speed up login processes.

Store passwords using bcrypt hashing with a work factor of 12, combined with a unique salt for each password, and store only the hashed version of the password.

130. When configuring SonarQube, which of the following properties must be set to connect it to a MySQL database for storing analysis results?

sonar.network.ip, sonar.network.port, sonar.network.protocol.

sonar.analysis.mode, sonar.projectKey, sonar.projectName.

sonar.host.url, sonar.login, sonar.password.

sonar.jdbc.url, sonar.jdbc.username, sonar.jdbc.password.

Page 14 of 15

131. Fill in the blank: Password hashing algorithms like bcrypt should be used instead of ____ to securely store user passwords and prevent them from being compromised.

Reversible encryption.

Plaintext password storage.

MD5 hashing.

Base64 encoding.

132. Fill in the blank: To manage secrets effectively in Kubernetes, it's essential to use __________ for

dynamically providing secrets to pods without hardcoding them.

Environment variables

Helm charts

ConfigMaps

Kubernetes Secrets

133. When configuring automated security tests in a GitLab CI/CD pipeline, which of the following tools would you use for dynamic security scanning?

nexpose: image: rapid7/nexpose-scan script: nexpose -H host -p port -t target

snyk: image: snyk/snyk-cli script: snyk test --project=my_project

zap: image: owasp/zap2docker-stable script: zap-full-scan.py -t http://example.com

fortify: image: microfocus/fortify-sca script: sourceanalyzer -b MyBuild -scan -f results.fpr

134. When implementing IAM roles for a serverless application, which policy ensures least privilege access to a DynamoDB table?

{"Version": "2012-10-17", "Statement": [{"Action": "dynamodb:", "Effect": "Allow", "Resource": ""}]}

{"Version": "2012-10-17", "Statement": [{"Action": ["dynamodb ", "dynamodb "], "Effect": "Allow", "Resource": "arn:aws:dynamodb:us-east-1:123456789012 /MyTable"}]}

{"Version": "2012-10-17", "Statement": [{"Action": ["dynamodb ", "dynamodb"], "Effect": "Allow", "Resource": "arn:aws:dynamodb:us-east-1:123456789012 /MyTable"}]}

{"Version": "2012-10-17", "Statement": [{"Action": "dynamodb ", "Effect": "Allow", "Resource": "arn:aws:dynamodb:us-east-1:123456789012 /*"}]}

135. Which configuration should be applied to enforce strong password policies that require a minimum password length, the use of special characters, and regular password rotation within a corporate network?

Allow password reuse after five password resets, enforce a minimum of 10 characters, and only require one type of character, such as numbers or letters.

Allow users to set passwords with a minimum of 6 characters, enforce complexity only if users fail to set strong passwords, and allow password rotation every 365 days.

Enforce a minimum password length of 8 characters, require numbers but no special characters, and allow password expiration every 180 days.

Enforce a minimum password length of 12 characters, require at least one special character, and implement a 90-day password expiration policy with multi-factor authentication.

136. In a Jenkins pipeline, how would you automate a Probely scan post-deployment?

always { run { shell: './run_probely_scan' } }

post { always { probelyScan 'projectKey', 'targetId', 'APIKey' } }

environment { post-deployment { executeProbely 'API_SECRET', 'siteID' } }

steps { script { sh 'probely_trigger_scan.sh' } }

137. When deploying a new version of a mobile app, what DevSecOps practice ensures that only secure, tested code is deployed to production environments?

Automatically update the app's security patches before each major release cycle.

Use a canary deployment strategy to gradually roll out the app to a subset of users before full deployment.

Require two-factor authentication for all developers before pushing to the production branch.

Implement a pre-deployment gate that includes manual security review and automated vulnerability scans.

138. Fill in the blank: To ensure secure API communication in mobile apps, it is critical to implement __________ on all sensitive data transmissions.

TLS encryption

VPN tunneling

Secure socket layer

SSH key exchange

139. Fill in the blank: For continuous security, it's critical to include __________ scripts that trigger vulnerability scans within the CI/CD pipeline to detect issues before production deployment.

preventive scanning

security protocols

vulnerability assessment

integrity check

140. A DevSecOps engineer is revising a project's GitHub repository. To enhance security, which configuration should be applied to ensure sensitive data isn’t accidentally committed?

A. Using client-side hooks in Git to scan for sensitive data before commits.

B. Applying branch protection rules to require pull request reviews before merging.

C. Configuring a .gitignore file to exclude files containing sensitive data like config/secrets.yml.

D. Enforcing a policy that commits must be signed with a GPG key.

Page 15 of 15

141. Which encryption algorithm should be applied to secure data in transit when establishing communication between a client and a server, ensuring compliance with modern encryption standards?

Use SSL 3.0 to encrypt all communication between the client and server.

Implement IPsec with manual key management for all communication sessions.

Implement TLS 1.3 with forward secrecy and perfect forward secrecy enabled.

Use AES-128 for securing communication channels with optional key renewal every 30 days.

142. A company's application uses several open-source libraries.

What strategy should be employed using Snyk to minimize the risk of introducing vulnerabilities through these libraries?

Regularly updating the libraries and running snyk monitor to track introduced dependencies and their vulnerabilities.

Limiting the use of open-source libraries to those vetted by an internal security team only.

Exclusively using libraries that provide an official security audit report with each release.

Disabling the use of all but the most essential libraries in the project to reduce dependency risks.

143. During a code review, you notice a function that connects to an external API.

Which technique should be employed to secure the API keys used within this function from exposure?

Implementing API keys within hidden HTML fields to obscure them from the client.

Using a secure vault service to manage and inject API keys at runtime.

Embedding API keys directly in the source code but using comments to obscure them.

Storing API keys in encrypted environment variables that are only accessible to the application and not stored within the source code.

144. Identify the configuration snippet that applies the principle of least privilege in securing API access to sensitive customer data.

Role-based access control with audit trails for all access requests and modifications to API settings.

Access control lists that restrict API endpoints to specific roles within the organization.

Mandatory access control systems that enforce policies defined by the administrator without exceptions.

Utilizing an encrypted token that grants access only when decrypted with a server-side private key.

145. When configuring role-based access control (RBAC) in an enterprise system, what configuration should be applied to ensure that users with administrative privileges can only access resources relevant to their job functions?

Configure global administrative privileges to allow users access to all resources without restrictions, ensuring they can troubleshoot system-wide issues.

Enable unrestricted admin access to all resources and enforce manual logging for user access across different services.

Implement flat file-based permissions where users with admin roles can modify all resources across the system.

Assign roles based on the principle of least privilege, ensuring that administrative roles have restricted access to non-essential systems.

146. A DevSecOps engineer is tasked with setting up a new SonarQube server.

What is the recommended minimum server specification for a production environment?

At least 4 CPU cores, 8 GB RAM, and 2 GB of available disk space.

It requires a dual-core processor with at least 16 GB RAM and 20 GB of disk space.

Minimum of 2 CPU cores, 4 GB RAM, and 500 MB of disk space.

Only 1 CPU core, 2 GB RAM, and 1 GB of disk space are needed.

147. What configuration should be set in a web application firewall to specifically filter out SQL injection attempts via input forms, considering the need for thorough scrutiny of incoming data?

Enable SSL/TLS to encrypt all data transmitted between the client and the server to prevent injection.

Set the rule to analyze and block patterns that match common SQL commands and escapes, like SELECT, INSERT, FROM, and ' or ".

Apply rate limiting on all input fields to reduce the chance of brute-force attacks leading to SQL injection.

Configure the server to only accept inputs shorter than 255 characters, reducing the potential payload size for injections.

148. A DevSecOps team is setting up an IAST tool to monitor a .NET application.

Which approach ensures the best integration for runtime analysis?

Utilizing a separate virtual machine to host the IAST tool and analyze traffic remotely.

Implementing the IAST agent as a middleware component within the application's architecture.

Configuring the application to send logs to an external IAST tool for analysis.

Adding the IAST tool as a plugin in the application's development environment.

149. For effective secure code reviews in a large project, which tool configuration file should be tailored to include project-specific security rules?

checkstyle.xml for Java projects, mainly to enforce coding standards and not specific security rules.

rubocop.yml for Ruby applications, focusing on style and lint checks rather than security.

.eslintrc.json for JavaScript projects, specifying custom rules for security reviews.

sonar-project.properties for integration with SonarQube to enhance code quality and security.

150. A DevSecOps engineer is tasked with setting up automated security checks for a Python-based application.

Which configuration ensures compliance with the secure coding practices recommended by Python Enhancement Proposals (PEP)?

Employing flake8 as a linter in the development environment to enforce style consistency.

Configuring mypy to enforce type checking as a proxy for secure coding practices.

Integrating pylint into their version control hooks to ensure coding standards are met before commits.

Setting up bandit -r . in the CI/CD pipeline to perform security analysis against the PEP 8 style guide.

312-97 EC-Council Certified DevSecOps Engineer (ECDE) Exam Free Dumps

312-97 EC-Council Certified DevSecOps Engineer (ECDE) Exam Free Dumps

Share this post

Related Posts