Free EC-Council EC-Council Certified DevSecOps Engineer 312-97 Exam Questions

GitGraber uses specific command-line flags to define how secret detection is performed. The -k flag is used to specify a keyword file that contains search terms for identifying sensitive data in repositories. In this case, William wants to search for secrets using the keyword ''yahoo,'' which is passed using the -q flag. Options -w, -g, and -p are not valid flags for keyword-based scanning in GitGraber. By using -k, GitGraber scans repositories for matches against the defined keywords and reports potential secret exposures in real time. This capability is especially valuable during the Code stage, helping teams prevent credential leakage and maintain secure repositories.

The docker commit command is used to create a new Docker image from the current state of a running or stopped container. This is useful when changes have been made interactively inside a container and need to be preserved as a reusable image. Commands such as docker push are used to upload images to a registry, not to create them, and container commit or container push are not valid Docker CLI commands. While docker commit can be helpful for quick snapshots or debugging, it is generally recommended to use Dockerfiles for reproducible builds in production pipelines. In the Build and Test stage, understanding docker commit helps DevSecOps engineers capture container changes for analysis, testing, or troubleshooting.

HashiCorp Vault provides a key-value (KV) secrets engine for securely storing sensitive data. To remove a secret from the KV store, the correct command is vault kv del . This command deletes the secret data at the specified path. Options using -delete or -del are syntactically incorrect, and vault kv delete is not a valid Vault CLI command. Proper secret deletion is an essential part of secret lifecycle management, especially when credentials may have been compromised. Performing this action during the Operate and Monitor stage helps contain security incidents, reduce exposure, and ensure that compromised secrets are no longer accessible. Timely deletion of secrets supports effective incident response and strengthens overall security posture.

Git requires developers to configure their identity using two specific configuration keys: user.name and user.email. These values are embedded into every commit and are essential for accountability, auditing, and collaboration. The correct configuration syntax uses dot-separated key names (user.name and user.email) and the --global flag to apply the settings across all repositories on the system. Among the provided options, only option B uses the correct configuration keys. The other options use invalid key names such as user-name, user_name, or incorrect command structure. Although the options display a minor command typo (''get config'' instead of git config), the question is clearly testing knowledge of the correct Git configuration keys. Configuring Git identity in the Code stage ensures accurate commit history and supports traceability across the DevSecOps pipeline.

Jenkins automatically assigns a unique identifier to each build using the environment variable BUILD_ID. When integrating OWASP ZAP with Jenkins, appending ${BUILD_ID} to output filenames or reports ensures that every scan result corresponds to a specific build execution. This avoids overwriting previous reports and allows traceability between build artifacts and security findings. Variables such as ${ZAPROXY_HOME} refer to installation paths, not build uniqueness, while ${Profile_ID} and ${zap_scan} are not standard Jenkins variables for uniquely identifying builds. Using ${BUILD_ID} supports better auditing, historical analysis, and correlation between detected vulnerabilities and the exact build in which they were found, which is critical during the Build and Test stage of a DevSecOps pipeline.

When integrating security controls at the CDN edge with AWS CloudFront, the typical deployment model uses Lambda@Edge, which allows code to execute at CloudFront edge locations on viewer request/response or origin request/response events. Deploying the tCell agent ''as a CloudFormation stack'' describes packaging the required AWS resources (IAM roles, functions, permissions, and CloudFront associations) into infrastructure-as-code, but the actual attachment point for CloudFront request/response processing is Lambda@Edge. Option C correctly reflects this: ''plugging into CloudFront through Lambda@Edge.'' Standard Lambda functions run in regional AWS environments and cannot directly run at CloudFront edge locations in the same way; therefore, ''CloudFront through Lambda Function'' is not the best match for edge enforcement needs like CSP handling and redirect protections. Options that claim ''plugging into CloudFormation'' misunderstand CloudFormation's role: it deploys resources, but it is not the runtime integration point. Hence, CloudFront + Lambda@Edge is the correct deployment approach.

The description matches AWS BugBust, which AWS positions as a gamified, team-based bug fixing challenge rather than a classic external ''bug bounty'' for finding vulnerabilities in AWS itself. The key hints are ''fun-based solution for bashing bugs,'' ''encouraging team building,'' and ''friendly competition,'' along with scoring points and awarding prizes. BugBust focuses on improving code quality by motivating developers to find and fix issues (often via static analysis findings) in languages like Java and Python. Participants earn points for remediations and compete on leaderboards, which aligns directly with Sarah ''scored the highest points'' and received a cash reward. The other names (BugFixer, BugFinder, BugHunt) are plausible-sounding but do not match the commonly referenced AWS gamified program described. In a DevSecOps context, this type of program supports culture by incentivizing secure coding habits, encouraging shared ownership of quality, and making remediation visible and rewarding across the engineering team.

Bandit is a Static Application Security Testing (SAST) tool developed specifically for analyzing Python source code. It scans Python scripts and applications to identify common security issues such as use of weak cryptography, hardcoded passwords, unsafe use of functions like eval, and insecure imports. Bandit works by parsing Python Abstract Syntax Trees (ASTs) and applying a set of security-focused rules. It does not support Java, Ruby, or C++ code, which require different static analysis tools tailored to their respective languages. By integrating Bandit with Jenkins during the Build and Test stage, Allen enables automated detection of Python-specific security flaws as soon as code changes are introduced. This shift-left approach reduces remediation costs, prevents vulnerable code from progressing further in the pipeline, and improves overall application security posture.

In a mature DevSecOps pipeline, security controls are enforced as gates, not merely as informational checks. When an SCA tool detects a critical vulnerability in a dependency---whether direct or transitive---the correct response at the Build and Test stage is to fail the build. This prevents vulnerable artifacts from moving forward into later stages such as deployment or production, where remediation would be more expensive and risky. Allowing the build to continue, even with notifications, contradicts the shift-left security principle. Ignoring transitive dependencies is also dangerous, as many real-world vulnerabilities originate from indirect libraries. Failing the build forces developers to remediate the issue immediately by upgrading, replacing, or mitigating the vulnerable dependency. This approach reduces attack surface, enforces accountability, and ensures that only secure artifacts are released. Therefore, stopping the pipeline upon detection of critical vulnerabilities reflects a strong DevSecOps maturity model and effective security governance.

Kubernetes clusters are managed and inspected using the kubectl command-line tool. To verify whether a Kubernetes cluster is functioning correctly, administrators commonly run kubectl version to confirm that both the client and server components are reachable and operational. This is followed by kubectl cluster-info, which displays information about the cluster's control plane and core services. These commands together confirm API server availability, cluster connectivity, and basic health status. The other options list invalid command names such as kube, kubernetes, or kube-etcd, which are not used for standard cluster validation. Performing these checks during the Operate and Monitor stage helps quickly identify whether application issues stem from cluster-level problems or application-level misconfigurations. This supports faster troubleshooting and more reliable production operations.