A company uses Jenkins for CI/CD and wants to automatically trigger a security scan of a Docker image after it is built and before it is pushed to the registry. Which integration should they implement?

Use a post-build action in Jenkins to send the image to a vulnerability scanner via email.

Add a Jenkins pipeline stage that runs a container image scanner (e.g., Trivy) and fails the build if critical vulnerabilities are found.

Schedule a nightly cron job to scan all images in the registry.

Configure the Docker registry to scan images on pull.

A company uses GitLab CI/CD. They want to automatically deploy a new version of an application to production only if the monitoring dashboard shows that the current version is healthy (e.g., error rate below 1%). Which approach best achieves this?

Manually review the monitoring dashboard before clicking deploy.

Use a CI job that queries the monitoring system's API and fails if the error rate is above the threshold.

Deploy the new version and then check the monitoring dashboard.

Use a cron job to deploy the new version every hour.

What is the primary purpose of continuous monitoring in a DevSecOps pipeline?

To enforce compliance by blocking all non-compliant code changes

To reduce the need for logging by using automated alerts

To provide ongoing visibility into security and operational health across the pipeline

To replace manual security testing with automated vulnerability scanning

How does continuous monitoring support compliance and auditing requirements?

By providing a record of security events and system activity

By eliminating the need for external audits

By automatically enforcing all security policies

By preventing all security incidents

A team is responsible for a high-traffic e-commerce site. They want to detect a potential distributed denial-of-service (DDoS) attack early, but they also want to avoid false positives that could trigger unnecessary auto-scaling and increase cloud costs. Which alerting strategy is most appropriate?

Alert on any increase in request rate above the daily average

Set a threshold on request rate that is 3 standard deviations above the historical baseline for the same time of day

Alert only when the request rate exceeds the maximum capacity of the infrastructure

Disable alerting and rely on manual monitoring of traffic graphs

EC-CouncilDevSecOps Essentials

Domain 3Objective 6

Continuous Monitoring Tools DSE Practice Questions (Page 7)

Part of the DevSecOps Toolchain domain, which makes up ~19% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 2–3 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

6concepts

Questions 31–35

31application · medium
A company uses Jenkins for CI/CD and wants to automatically trigger a security scan of a Docker image after it is built and before it is pushed to the registry. Which integration should they implement?
Select an answer first
32expert · hard
A company uses GitLab CI/CD. They want to automatically deploy a new version of an application to production only if the monitoring dashboard shows that the current version is healthy (e.g., error rate below 1%). Which approach best achieves this?
Select an answer first
33foundation · easy
What is the primary purpose of continuous monitoring in a DevSecOps pipeline?
Select an answer first
34foundation · easy
How does continuous monitoring support compliance and auditing requirements?
Select an answer first
35expert · hard
A team is responsible for a high-traffic e-commerce site. They want to detect a potential distributed denial-of-service (DDoS) attack early, but they also want to avoid false positives that could trigger unnecessary auto-scaling and increase cloud costs. Which alerting strategy is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DSE” is a trademark of its owner, used for identification only.