A team discovers that a widely used open-source library in their application has a critical vulnerability. They want to automatically identify all projects using the affected version and block builds until the library is updated. What should they implement?

Manual review of all project dependency files.

SAST tool that scans the library's source code.

SCA tool integrated into CI that fails the build on vulnerable versions.

DAST tool that tests the library at runtime.

In a CI/CD pipeline, at which stage is SAST typically integrated?

During the build or commit stage

After the application is deployed to production

During the user acceptance testing phase

Only during scheduled quarterly security audits

What is the primary purpose of vulnerability management after an assessment?

To generate a report for compliance only

To prioritize, track, and remediate identified vulnerabilities

To delete the application if vulnerabilities are found

To automatically patch all vulnerabilities without testing

What does a Static Application Security Testing (SAST) tool primarily analyze?

Source code without executing the application

Running application behavior and responses

Open-source libraries for known vulnerabilities

Network traffic and firewall logs

A team uses multiple security tools in their CI/CD pipeline: SAST, DAST, SCA, and IAST. Each tool produces its own report in a different format. The security team wants a single consolidated view of all findings to track remediation. What should the team do?

Manually copy the findings from each tool's report into a spreadsheet.

Use a security orchestration platform that ingests results from all tools and normalizes them into a single dashboard.

Run only one tool and rely on its report for all security findings.

Store each report in a separate folder and review them individually.

EC-CouncilDevSecOps Essentials

Domain 4Objective 5

Application Assessments and Penetration Testing DSE Practice Questions (Page 9)

Part of the DevSecOps Pipelines and CI/CD Security domain, which makes up ~18% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 2–3 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

10concepts

10 Concepts in This Objective

Application Assessment Fundamentals
Threat Modeling for Applications
Static Application Security Testing (SAST)
Dynamic Application Security Testing (DAST)
Interactive Application Security Testing (IAST)
Software Composition Analysis (SCA)
Penetration Testing in CI/CD
Vulnerability Management and Remediation
Security Testing Tools Integration
Reporting and Metrics for Security Assessments

Questions 41–45

41application · medium
A team discovers that a widely used open-source library in their application has a critical vulnerability. They want to automatically identify all projects using the affected version and block builds until the library is updated. What should they implement?
Select an answer first
42foundation · easy
In a CI/CD pipeline, at which stage is SAST typically integrated?
Select an answer first
43foundation · easy
What is the primary purpose of vulnerability management after an assessment?
Select an answer first
44foundation · easy
What does a Static Application Security Testing (SAST) tool primarily analyze?
Select an answer first
45application · medium
A team uses multiple security tools in their CI/CD pipeline: SAST, DAST, SCA, and IAST. Each tool produces its own report in a different format. The security team wants a single consolidated view of all findings to track remediation. What should the team do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DSE” is a trademark of its owner, used for identification only.