A pipeline builds a deployable package and pushes it to an artifact repository. The team wants to ensure that only packages that have passed all security checks are deployable. What should they configure in the pipeline?

A security gate that marks the package as verified only after all checks pass.

A log entry that records the security check results.

A separate repository for packages that have not passed checks.

A notification to the security team when the package is built.

A pipeline builds a container image, scans it for vulnerabilities, and then pushes it to a registry. The security team wants to ensure that the image deployed to production is exactly the one that was scanned. Which additional control should be implemented?

Restrict access to the registry using IAM policies.

Re-scan the image in the production environment.

Use a checksum stored in the registry metadata.

Sign the image after scanning and verify the signature before deployment.

Which of the following is an example of a security gate in a pipeline?

Requiring a manager's approval before deployment

Storing build artifacts in a central repository

Failing the build if a SAST scan reports a critical vulnerability

Sending an email notification when a build completes

A company uses a central artifact repository for all build outputs. They want to prevent a compromised build server from pushing malicious artifacts. What should be implemented?

Use a firewall to restrict access to the repository.

Require that artifacts be signed by a trusted key and verify the signature before accepting them into the repository.

Rely on the build server's antivirus software.

Store artifacts in a separate repository for each build server.

A web application team wants to automatically detect security vulnerabilities in their custom code and in third-party libraries. They want to run these checks in the pipeline before deployment. Which combination of automated tests should they implement?

Dependency scanning for custom code and SAST for libraries.

DAST for custom code and SAST for libraries.

SAST for custom code and dependency scanning for libraries.

Manual code review for custom code and dependency scanning for libraries.

EC-CouncilDevSecOps Essentials

Domain 4Objective 3

Integrating Security into the DevOps Pipeline DSE Practice Questions (Page 2)

Part of the DevSecOps Pipelines and CI/CD Security domain, which makes up ~18% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 2–3 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 6–10

6application · medium
A pipeline builds a deployable package and pushes it to an artifact repository. The team wants to ensure that only packages that have passed all security checks are deployable. What should they configure in the pipeline?
Select an answer first
7expert · hard
A pipeline builds a container image, scans it for vulnerabilities, and then pushes it to a registry. The security team wants to ensure that the image deployed to production is exactly the one that was scanned. Which additional control should be implemented?
Select an answer first
8foundation · easy
Which of the following is an example of a security gate in a pipeline?
Select an answer first
9application · medium
A company uses a central artifact repository for all build outputs. They want to prevent a compromised build server from pushing malicious artifacts. What should be implemented?
Select an answer first
10application · medium
A web application team wants to automatically detect security vulnerabilities in their custom code and in third-party libraries. They want to run these checks in the pipeline before deployment. Which combination of automated tests should they implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DSE” is a trademark of its owner, used for identification only.