ECCouncil 312-97 actual dump : EC-Council Certified DevSecOps Engineer (ECDE)

Emma Rodriguez, a DevSecOps engineer at CyberNova Ltd., is responsible for securing a cloud-native e-commerce platform. Despite implementing security best practices during code commits, builds, and testing, the team recently discovered security vulnerabilities in the production environment, such as misconfigured cloud storage permissions and exposed API keys. To prevent similar issues, Emma decides to implement a final layer of security to identify vulnerabilities that are missed in pre-production testing activities.

• A. By performing commit-time checks.
• B. By performing test-time checks.
• C. By performing deploy-time checks.
• D. By performing build-time checks.

Sophia, a software engineer, is responsible for deploying applications efficiently within her team. She often finds it cumbersome to switch between multiple tools and interfaces to execute deployment workflows. To streamline this process, she decides to use Kubiya, an AI-driven DevOps assistant. By leveraging Kubiya's conversational AI interface, Sophia simply runs a single command to initiate the deployment, eliminating the need for manual intervention across different platforms. This allows her to focus on higher-value tasks while ensuring smooth and efficient deployments. Which core concept of Kubiya enables this streamlined deployment process?

• A. It streamlines the deployment process through conversational AI.
• B. It prevents all misconfigurations during deployment.
• C. It eliminates the need for CI/CD pipelines.
• D. It replaces traditional deployment scripts with AI-generated automation.

An healthcare organization suffered a data breach after attackers exploited a known vulnerability in the OpenSSL library within one of its containerized applications. Upon investigation, the DevSecOps team discovered that the container image used in production was outdated, exposing it to security risks.There was no automated vulnerability scanning during the development and deployment phases. The lack of a secure container registry led to unverified and potentially insecure images being deployed. To prevent such security incidents in the future, the team decides to implement a solution that securely stores container images and automatically scans them for vulnerabilities before deployment. Which tool should the team use?

• A. Jenkins.
• B. Terraform.
• C. Kubernetes.
• D. Amazon Elastic Container Registry (ECR).

Ethan Roberts, a DevSecOps engineer at SecureSoft Technologies, is responsible for securing software products and web applications throughout the development lifecycle. To enhance security testing, he implements Interactive Application Security Testing (IAST), which allows him to analyze source code for vulnerabilities in real-time, monitor security issues dynamically as the application runs, utilize IAST across the development, QA, and production stages to identify vulnerabilities early, and reduce remediation costs by detecting issues before deployment. Ethan's team is particularly interested in how IAST integrates both SAST and DAST capabilities. They observe that IAST can analyze every line of code statically (SAST) and examine every request and response dynamically (DAST). How does IAST achieve this dual functionality?

• A. Because IAST has access to offline and runtime environments.
• B. Because IAST has access to both internal and external security agents.
• C. Because IAST has access to the source code and HTTP traffic.
• D. Because IAST has access to both the server and local machine.

A security engineer is conducting a security audit of an organization's Google Cloud Platform (GCP) environment. As part of the assessment, they are tasked with integrating Intruder, a vulnerability assessment tool, into the CI/CD pipeline to enhance security monitoring. To ensure seamless, read-only access to required GCP resources, the engineer chooses to use OAuth for authentication. However, during the configuration phase, the integration fails due to insufficient permissions. Upon reviewing the settings, the engineer determines that the issue is related to missing OAuth scopes required for proper integration. Which of the following actions should the engineer take to resolve the issue?

• A. Assign limited OAuth permissions only to Compute Engine and Cloud DNS, restricting Cloud Platform access.
• B. Manually configure OAuth to access DNS, Compute Engine, and Cloud Platform project scopes.
• C. Replace OAuth authentication with a service account that has elevated privileges to bypass scope restrictions.
• D. Modify OAuth settings to exclude Cloud Platform project scope while keeping DNS and Compute Engine permissions.