What is the main idea behind a 'shift-left' testing strategy?

To shift testing responsibilities to the operations team

To use only dynamic testing tools

To perform testing only at the end of the development cycle

To move testing earlier in the development lifecycle

A team wants to reduce false positives in security testing while getting real-time feedback during automated functional tests. They want the tool to observe the application's execution and trace data flow to confirm whether a vulnerability is actually exploitable. Which approach fits this requirement?

Use an SCA tool to check for known vulnerabilities in dependencies.

Run a SAST scan on the source code and manually review all findings.

Run a DAST scan against the deployed application after the functional tests complete.

Use an interactive application security testing (IAST) tool that instruments the application during test execution.

Which type of vulnerability is most likely to be identified by a SAST tool?

A SQL injection flaw in the source code

A team wants to ensure that developers receive immediate, actionable feedback when a security test fails in the CI pipeline, so they can fix the issue quickly. Which approach best supports this feedback loop?

Only display the pass/fail status on the CI dashboard without any details.

Send a summary of all test results to the engineering manager once a week.

Configure the CI system to send the failing test report, including the vulnerability details and the commit that introduced it, directly to the developer.

Store the test results in a central database and require developers to check it manually at the end of the sprint.

What is the primary function of a Software Composition Analysis (SCA) tool?

To scan the application's source code for custom coding flaws

To identify known vulnerabilities and license issues in third-party components

To monitor the application's runtime performance

To test the running application for vulnerabilities

EC-CouncilDevSecOps Essentials

Domain 3Objective 3

Continuous Testing Tools DSE Practice Questions (Page 11)

Part of the DevSecOps Toolchain domain, which makes up ~19% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 2–3 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

10concepts

10 Concepts in This Objective

Continuous testing fundamentals
Test automation in CI/CD
Static application security testing (SAST)
Dynamic application security testing (DAST)
Software composition analysis (SCA)
Interactive application security testing (IAST)
Test coverage and quality gates
Shift-left testing strategy
Continuous testing tool integration
Reporting and feedback loops

Questions 51–55

51foundation · easy
What is the main idea behind a 'shift-left' testing strategy?
Select an answer first
52application · medium
A team wants to reduce false positives in security testing while getting real-time feedback during automated functional tests. They want the tool to observe the application's execution and trace data flow to confirm whether a vulnerability is actually exploitable. Which approach fits this requirement?
Select an answer first
53foundation · easy
Which type of vulnerability is most likely to be identified by a SAST tool?
Select an answer first
54application · medium
A team wants to ensure that developers receive immediate, actionable feedback when a security test fails in the CI pipeline, so they can fix the issue quickly. Which approach best supports this feedback loop?
Select an answer first
55foundation · easy
What is the primary function of a Software Composition Analysis (SCA) tool?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DSE” is a trademark of its owner, used for identification only.