A DevOps team is writing Terraform templates to provision cloud infrastructure. They want to automatically check the templates for security misconfigurations before applying them. What should they add to their CI/CD pipeline?

A manual review of the templates by a security engineer.

A script that runs `terraform plan` and checks the output for errors.

A static analysis step that runs a policy-as-code tool on the Terraform templates.

A runtime scan of the deployed infrastructure after `terraform apply`.

An infrastructure team writes Terraform templates to provision cloud resources. They want to catch misconfigurations such as open security groups or unencrypted storage before deployment. Which action should be added to the pipeline?

Deploy the templates to a test environment and then run a vulnerability scanner on the running resources.

Run a static analysis tool on the Terraform templates during the CI stage.

Manually review the templates in a code review meeting.

Use a runtime agent to monitor the cloud environment after deployment.

A team is using a public package repository to fetch dependencies during builds. They are concerned about supply chain attacks where a malicious package with the same name as a legitimate one is published. What is the most effective way to mitigate this risk?

Use the latest version of each package to ensure security fixes are included.

Use a private repository that proxies the public one and pins dependencies to verified versions.

Scan all dependencies with SAST.

Rely on the public repository's community reviews to identify malicious packages.

Which of the following is a valid security control that can be embedded in the post-deployment stage of a DevOps pipeline?

Checking for hardcoded secrets in the repository

Scanning container images for known vulnerabilities

Performing a static application security test (SAST) on the source code

Running a dynamic application security test (DAST) against the deployed application

Which practice helps prevent tampering with artifacts stored in a repository?

Storing artifacts in plain text for easy access

Using shared credentials for repository access

Using immutable artifact versions

Allowing all developers to delete artifacts

EC-CouncilDevSecOps Essentials

Domain 4Objective 3

Integrating Security into the DevOps Pipeline DSE Practice Questions (Page 7)

Part of the DevSecOps Pipelines and CI/CD Security domain, which makes up ~18% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 2–3 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 31–35

31application · medium
A DevOps team is writing Terraform templates to provision cloud infrastructure. They want to automatically check the templates for security misconfigurations before applying them. What should they add to their CI/CD pipeline?
Select an answer first
32application · medium
An infrastructure team writes Terraform templates to provision cloud resources. They want to catch misconfigurations such as open security groups or unencrypted storage before deployment. Which action should be added to the pipeline?
Select an answer first
33expert · hard
A team is using a public package repository to fetch dependencies during builds. They are concerned about supply chain attacks where a malicious package with the same name as a legitimate one is published. What is the most effective way to mitigate this risk?
Select an answer first
34foundation · easy
Which of the following is a valid security control that can be embedded in the post-deployment stage of a DevOps pipeline?
Select an answer first
35foundation · easy
Which practice helps prevent tampering with artifacts stored in a repository?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DSE” is a trademark of its owner, used for identification only.