A team uses a central artifact repository to store build outputs. They want to ensure that only authorized builds are deployed and that artifacts have not been altered. What should they implement?

Store artifacts in a database instead of a file repository.

Sign artifacts during the build and verify the signature before deployment.

Restrict access to the repository using a firewall.

Use a naming convention that includes the build number.

What is the goal of continuous compliance monitoring in a DevOps pipeline?

To ensure that the deployed environment remains compliant with policies over time

To automatically fix all compliance violations without human intervention

To replace the need for any manual security reviews

To perform a one-time security audit before the initial deployment

A company must demonstrate compliance with a security standard that requires vulnerability scans to be run on all production code. They have a mix of legacy and modern applications. The legacy applications are not built through the CI/CD pipeline. What is the most effective way to achieve continuous compliance monitoring?

Integrate scanning into the CI/CD pipeline for modern apps and schedule periodic scans for legacy apps.

Run a one-time scan of all legacy applications and assume they are compliant.

Require manual testing for legacy applications and automated scanning for modern ones.

Only scan modern applications and document that legacy apps are out of scope.

A pipeline needs to access a database using a password. The security team wants to avoid storing the password in the pipeline configuration file. Which method should be used?

Use a secrets manager to store the password and retrieve it during the pipeline run.

Encrypt the password and store it in the repository.

Put the password in an environment variable in the pipeline configuration.

Ask a developer to type the password when the pipeline runs.

An organization requires that no container image be promoted to production unless it has passed vulnerability scanning and compliance checks. What should be implemented in the pipeline to enforce this requirement?

A notification to the security team when a scan finds a critical vulnerability.

A manual approval step in the pipeline that requires a security team member to sign off.

A security gate in the pipeline that blocks promotion if scan results exceed the defined threshold.

A post-deployment audit that reviews scan results after the image is in production.

EC-CouncilDevSecOps Essentials

Domain 4Objective 3

Integrating Security into the DevOps Pipeline DSE Practice Questions (Page 3)

Part of the DevSecOps Pipelines and CI/CD Security domain, which makes up ~18% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 2–3 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 11–15

11application · medium
A team uses a central artifact repository to store build outputs. They want to ensure that only authorized builds are deployed and that artifacts have not been altered. What should they implement?
Select an answer first
12foundation · easy
What is the goal of continuous compliance monitoring in a DevOps pipeline?
Select an answer first
13expert · hard
A company must demonstrate compliance with a security standard that requires vulnerability scans to be run on all production code. They have a mix of legacy and modern applications. The legacy applications are not built through the CI/CD pipeline. What is the most effective way to achieve continuous compliance monitoring?
Select an answer first
14application · medium
A pipeline needs to access a database using a password. The security team wants to avoid storing the password in the pipeline configuration file. Which method should be used?
Select an answer first
15application · medium
An organization requires that no container image be promoted to production unless it has passed vulnerability scanning and compliance checks. What should be implemented in the pipeline to enforce this requirement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DSE” is a trademark of its owner, used for identification only.