A team wants to integrate SAST, DAST, and SCA tools into their CI pipeline. They want to avoid duplicate findings and have a single view of all vulnerabilities. What should they implement?

Store raw outputs in a shared folder without processing.

A centralized results aggregator that correlates findings from all tools.

Use only one tool that claims to do everything.

Run each tool independently and review separate reports.

A security team needs to report the effectiveness of their DevSecOps pipeline to management. They want to show trends in vulnerability detection and remediation over time. Which metric would be most useful for this purpose?

The total number of security tools used in the pipeline.

The number of developers on the team.

The time it takes for the pipeline to complete.

The number of vulnerabilities found and remediated per release cycle, tracked over time.

What is the primary purpose of Software Composition Analysis (SCA)?

To identify known vulnerabilities and license risks in open-source components

To monitor network traffic for malicious activity

To test the application's user interface for usability issues

To analyze the application's runtime behavior for security flaws

A company uses many open-source libraries in their application. They want to ensure that they are not using libraries with known vulnerabilities and that the licenses are compatible with their proprietary software. Which tool should they integrate into their pipeline?

SCA (Software Composition Analysis)

IAST (Interactive Application Security Testing)

DAST (Dynamic Application Security Testing)

SAST (Static Application Security Testing)

EC-CouncilDevSecOps Essentials

Domain 4Objective 5

Application Assessments and Penetration Testing DSE Practice Questions (Page 1)

Part of the DevSecOps Pipelines and CI/CD Security domain, which makes up ~18% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 2–3 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

10concepts

10 Concepts in This Objective

Application Assessment Fundamentals
Threat Modeling for Applications
Static Application Security Testing (SAST)
Dynamic Application Security Testing (DAST)
Interactive Application Security Testing (IAST)
Software Composition Analysis (SCA)
Penetration Testing in CI/CD
Vulnerability Management and Remediation
Security Testing Tools Integration
Reporting and Metrics for Security Assessments

Questions 1–5

1application · medium
A team wants to integrate SAST, DAST, and SCA tools into their CI pipeline. They want to avoid duplicate findings and have a single view of all vulnerabilities. What should they implement?
Select an answer first
2foundation · easy
Which of the following is a structured threat modeling technique commonly used to identify threats?
Select an answer first
3application · medium
A security team needs to report the effectiveness of their DevSecOps pipeline to management. They want to show trends in vulnerability detection and remediation over time. Which metric would be most useful for this purpose?
Select an answer first
4foundation · easy
What is the primary purpose of Software Composition Analysis (SCA)?
Select an answer first
5application · medium
A company uses many open-source libraries in their application. They want to ensure that they are not using libraries with known vulnerabilities and that the licenses are compatible with their proprietary software. Which tool should they integrate into their pipeline?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DSE” is a trademark of its owner, used for identification only.