At which stage of a CI/CD pipeline is container image scanning most effectively integrated?

After building the container image and before pushing to a registry

During the initial code commit stage

A team is using Terraform to manage infrastructure and wants to implement automated security testing. They have a set of custom security policies that are specific to their organization. They want to test these policies against their Terraform plans before deployment. They also want to ensure that the policies themselves are tested to avoid false positives. What is the best approach?

Run the Terraform plan checks in the pipeline but do not test the policies themselves.

Write the policies in a document and manually compare them to the Terraform plans.

Use a third-party policy library without customizing it for the organization.

Use a policy-as-code framework to write the policies, and create unit tests for the policies that run in the CI pipeline alongside the Terraform plan checks.

What is the purpose of continuous security monitoring in a DevSecOps environment?

To ensure that security scans are run only once per release

To track security metrics and alert on issues in real time

To replace all security tools with manual checks

To generate reports only at the end of the year

What is the recommended way to store secrets used in a CI/CD pipeline?

In a shared document accessible to all team members

In plain text within the pipeline configuration file

In a dedicated secrets management vault with access controls

In the source code repository as environment variables

What is 'drift' in the context of Infrastructure as Code security?

The difference between the desired state defined in IaC and the actual state of the deployed infrastructure

The process of updating IaC templates to the latest version

The time it takes to deploy infrastructure

The failure of a CI/CD pipeline due to a syntax error

EC-CouncilDevSecOps Essentials

Domain 4Objective 4

Continuous Security with Security as Code DSE Practice Questions (Page 6)

Part of the DevSecOps Pipelines and CI/CD Security domain, which makes up ~18% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 2–3 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

8concepts

Questions 26–30

26foundation · easy
At which stage of a CI/CD pipeline is container image scanning most effectively integrated?
Select an answer first
27expert · hard
A team is using Terraform to manage infrastructure and wants to implement automated security testing. They have a set of custom security policies that are specific to their organization. They want to test these policies against their Terraform plans before deployment. They also want to ensure that the policies themselves are tested to avoid false positives. What is the best approach?
Select an answer first
28foundation · easy
What is the purpose of continuous security monitoring in a DevSecOps environment?
Select an answer first
29foundation · easy
What is the recommended way to store secrets used in a CI/CD pipeline?
Select an answer first
30foundation · easy
What is 'drift' in the context of Infrastructure as Code security?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DSE” is a trademark of its owner, used for identification only.