A team is planning to integrate security into their DevOps pipeline. They want to minimize the cost of fixing vulnerabilities. Which strategy is most aligned with shift-left security?

Use a single security scan in the staging environment.

Run security scans only in the production environment.

Run security scans as early as possible in the development lifecycle, such as during code commit and build.

Defer security testing until the end of the release cycle.

A healthcare company must comply with data protection regulations. They want to ensure that every deployment to production meets specific encryption and access control requirements. What is the most effective way to achieve this?

Train developers on compliance requirements.

Integrate automated compliance checks into the pipeline as a mandatory gate before production deployment.

Conduct a quarterly audit of production environments.

Use a cloud provider that is certified for healthcare.

What is the purpose of scanning Infrastructure as Code (IaC) templates for security issues?

To automatically deploy the infrastructure without manual intervention

To identify misconfigurations that could lead to security vulnerabilities

To optimize the performance of the infrastructure

To convert the IaC templates into a different format

A pipeline runs in a shared build environment where multiple teams execute jobs. The team needs to use a database password in a deployment job. They are concerned that other teams might be able to read the password from the environment. What is the most secure way to handle this?

Put the password in a file in the build workspace and delete it after the job.

Use a secrets management service that provides the secret only to the specific job with scoped access.

Use a hard-coded password in the deployment script.

Store the password in a shared environment variable that all jobs can access.

EC-CouncilDevSecOps Essentials

Domain 4Objective 3

Integrating Security into the DevOps Pipeline DSE Practice Questions (Page 10)

Part of the DevSecOps Pipelines and CI/CD Security domain, which makes up ~18% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 2–3 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 46–49

46application · medium
A team is planning to integrate security into their DevOps pipeline. They want to minimize the cost of fixing vulnerabilities. Which strategy is most aligned with shift-left security?
Select an answer first
47application · medium
A healthcare company must comply with data protection regulations. They want to ensure that every deployment to production meets specific encryption and access control requirements. What is the most effective way to achieve this?
Select an answer first
48foundation · easy
What is the purpose of scanning Infrastructure as Code (IaC) templates for security issues?
Select an answer first
49expert · hard
A pipeline runs in a shared build environment where multiple teams execute jobs. The team needs to use a database password in a deployment job. They are concerned that other teams might be able to read the password from the environment. What is the most secure way to handle this?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to DSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DSE” is a trademark of its owner, used for identification only.