A startup is building a new CI/CD pipeline and wants to adopt Security as Code principles. They want to ensure that security policies are treated like software code, with version control, code review, and automated testing. Which practice best aligns with this principle?

Store policies in a shared network drive with no version control or change management.

Document security policies in a wiki page and ask developers to read it before committing code.

Store security policies in a Git repository, require pull requests for changes, and run automated policy tests in the CI pipeline.

Use a security consultant to review policies annually and update them manually.

What is the purpose of automated security testing in a CI/CD pipeline?

To replace all manual security reviews permanently

To continuously validate that security controls work as expected

To generate security reports for auditors only

To slow down the pipeline for thorough analysis

A DevOps team is building a CI/CD pipeline that deploys to multiple environments (dev, staging, prod). They need to use different credentials for each environment. They want to ensure that the credentials are not accessible to developers who only work on the dev environment, and that the pipeline can rotate credentials without manual intervention. What is the best approach?

Create separate pipeline configurations for each environment, each with hard-coded credentials.

Use a secrets vault with environment-specific paths and access policies, and configure the pipeline to retrieve credentials based on the target environment using the pipeline's identity.

Use the same credentials for all environments to simplify management.

Store all credentials in a single environment variable file that is accessible to all developers.

An organization uses AWS CloudFormation to manage infrastructure. They want to prevent developers from accidentally creating publicly accessible S3 buckets. They also want to ensure that any change to the infrastructure is reviewed and tested before deployment. What should they do?

Create a manual checklist that developers must complete before deploying CloudFormation templates.

Add a policy-as-code check in the CI pipeline that fails the build if the CloudFormation template contains a public S3 bucket, and require a pull request for template changes.

Monitor S3 buckets after deployment and alert if any become public.

Use an S3 bucket policy that denies public access at the account level.

EC-CouncilDevSecOps Essentials

Domain 4Objective 4

Continuous Security with Security as Code DSE Practice Questions (Page 4)

Part of the DevSecOps Pipelines and CI/CD Security domain, which makes up ~18% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 2–3 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

8concepts

Questions 16–20

16application · medium
A startup is building a new CI/CD pipeline and wants to adopt Security as Code principles. They want to ensure that security policies are treated like software code, with version control, code review, and automated testing. Which practice best aligns with this principle?
Select an answer first
17foundation · easy
What is the purpose of automated security testing in a CI/CD pipeline?
Select an answer first
18expert · hard
A DevOps team is building a CI/CD pipeline that deploys to multiple environments (dev, staging, prod). They need to use different credentials for each environment. They want to ensure that the credentials are not accessible to developers who only work on the dev environment, and that the pipeline can rotate credentials without manual intervention. What is the best approach?
Select an answer first
19application · medium
An organization uses AWS CloudFormation to manage infrastructure. They want to prevent developers from accidentally creating publicly accessible S3 buckets. They also want to ensure that any change to the infrastructure is reviewed and tested before deployment. What should they do?
Select an answer first
20foundation · easy
What is a common framework used for Policy as Code?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DSE” is a trademark of its owner, used for identification only.

Continuous Security with Security as Code DSE Practice Questions (Page 4)

Questions 16–20

A startup is building a new CI/CD pipeline and wants to adopt Security as Code principles. They want to ensure that security policies are treated like software code, with version control, code review, and automated testing. Which practice best aligns with this principle?

What is the purpose of automated security testing in a CI/CD pipeline?

An organization uses AWS CloudFormation to manage infrastructure. They want to prevent developers from accidentally creating publicly accessible S3 buckets. They also want to ensure that any change to the infrastructure is reviewed and tested before deployment. What should they do?

What is a common framework used for Policy as Code?

Keep studying — DevSecOps Pipelines and CI/CD Security