A development team wants to automatically block a deployment if the new build introduces a critical vulnerability that is detected by their SAST tool. The SAST tool outputs a report in SARIF format. Which CI/CD integration approach best achieves this?

Configure the SAST tool to send an email to the security team on critical findings.

Store the SARIF report in an artifact repository for future auditing.

Run the SAST tool manually after deployment and review findings in a dashboard.

Use a CI plugin that parses the SARIF report and fails the pipeline if any critical finding is present.

How do continuous monitoring tools integrate with CI/CD pipelines to provide real-time feedback?

By sending metrics and alerts to the pipeline to trigger automated responses

By scanning code for vulnerabilities after deployment

By replacing the need for testing in the pipeline

By providing a dashboard for developers to view after the release

A company uses Jenkins for CI/CD and wants to implement a security gate that blocks deployment if a vulnerability scan finds critical issues. However, the security team is concerned that the scan takes too long and slows down the pipeline. Which approach balances security and pipeline speed?

Skip the scan for small changes and only scan major releases.

Increase the scan timeout to ensure it completes, but do not fail the build on findings.

Run the full vulnerability scan in parallel with other pipeline stages and fail the build if critical findings are reported.

Run the scan only on a nightly basis and review results the next day.

A regulated company must deploy a new application. They have a policy that any deployment must be automatically rolled back if the application's error rate exceeds 2% within 15 minutes. However, the monitoring system's API has a latency of up to 5 minutes. The team wants to ensure the rollback decision is based on accurate data. What should they do?

Evaluate the error rate immediately after deployment using the first available data point

Roll back the deployment if the error rate exceeds 2% at any point during the first 15 minutes

Configure the pipeline to wait for at least 15 minutes of monitoring data before evaluating the error rate, accounting for API latency

Ignore the monitoring data and rely on manual verification after 30 minutes

EC-CouncilDevSecOps Essentials

Domain 3Objective 6

Continuous Monitoring Tools DSE Practice Questions (Page 3)

Part of the DevSecOps Toolchain domain, which makes up ~19% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 2–3 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

6concepts

Questions 11–15

11application · medium
A development team wants to automatically block a deployment if the new build introduces a critical vulnerability that is detected by their SAST tool. The SAST tool outputs a report in SARIF format. Which CI/CD integration approach best achieves this?
Select an answer first
12foundation · easy
Which component in the Elastic Stack is responsible for ingesting and processing logs?
Select an answer first
13foundation · easy
How do continuous monitoring tools integrate with CI/CD pipelines to provide real-time feedback?
Select an answer first
14expert · hard
A company uses Jenkins for CI/CD and wants to implement a security gate that blocks deployment if a vulnerability scan finds critical issues. However, the security team is concerned that the scan takes too long and slows down the pipeline. Which approach balances security and pipeline speed?
Select an answer first
15expert · hard
A regulated company must deploy a new application. They have a policy that any deployment must be automatically rolled back if the application's error rate exceeds 2% within 15 minutes. However, the monitoring system's API has a latency of up to 5 minutes. The team wants to ensure the rollback decision is based on accurate data. What should they do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DSE” is a trademark of its owner, used for identification only.

Continuous Monitoring Tools DSE Practice Questions (Page 3)

Questions 11–15

A development team wants to automatically block a deployment if the new build introduces a critical vulnerability that is detected by their SAST tool. The SAST tool outputs a report in SARIF format. Which CI/CD integration approach best achieves this?

Which component in the Elastic Stack is responsible for ingesting and processing logs?

How do continuous monitoring tools integrate with CI/CD pipelines to provide real-time feedback?

A company uses Jenkins for CI/CD and wants to implement a security gate that blocks deployment if a vulnerability scan finds critical issues. However, the security team is concerned that the scan takes too long and slows down the pipeline. Which approach balances security and pipeline speed?

Keep studying — DevSecOps Toolchain