A DevSecOps team wants to ensure that developers receive security findings from the pipeline as quickly as possible, ideally before they move on to other tasks. Which feedback mechanism is most effective?

Post the security scan results as comments on the pull request that triggered the pipeline.

Store the findings in a separate security dashboard that developers must check manually.

Only show the findings to the security team and let them communicate issues to developers.

Send a weekly email digest of all security findings to the development team.

A company's build pipeline downloads open-source libraries from a public repository. They want to ensure that a compromised library version is not used in production builds. Which control should be added to the pipeline?

Pin dependencies to exact versions and run a software composition analysis (SCA) tool that checks against vulnerability databases.

Rely on the public repository's own security scanning to block malicious packages.

Scan the final container image only after deployment to production.

Use the latest version of each library automatically to ensure all security patches are applied.

A team is designing a pipeline for a legacy application that has a long build time and no existing automated tests. They want to introduce security checks without significantly delaying releases. They also need to provide developers with actionable feedback. Which approach best balances these constraints?

Start with a lightweight SAST and secret scanning stage in the commit stage, and add a DAST stage in the staging environment that runs in parallel with other staging tests.

Require a full SAST, DAST, and SCA scan on every commit, and block the pipeline until all scans pass.

Deploy to production first and run security scans against the production environment.

Run all security checks only in a nightly batch and email the results to the security team.

EC-CouncilDevSecOps Essentials

Domain 4Objective 2

Key Elements of the DevSecOps Pipeline DSE Practice Questions (Page 10)

Part of the DevSecOps Pipelines and CI/CD Security domain, which makes up ~18% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 2–3 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

8concepts

Questions 46–48

46application · medium
A DevSecOps team wants to ensure that developers receive security findings from the pipeline as quickly as possible, ideally before they move on to other tasks. Which feedback mechanism is most effective?
Select an answer first
47application · medium
A company's build pipeline downloads open-source libraries from a public repository. They want to ensure that a compromised library version is not used in production builds. Which control should be added to the pipeline?
Select an answer first
48expert · hard
A team is designing a pipeline for a legacy application that has a long build time and no existing automated tests. They want to introduce security checks without significantly delaying releases. They also need to provide developers with actionable feedback. Which approach best balances these constraints?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to DSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DSE” is a trademark of its owner, used for identification only.

Key Elements of the DevSecOps Pipeline DSE Practice Questions (Page 10)

Questions 46–48

A DevSecOps team wants to ensure that developers receive security findings from the pipeline as quickly as possible, ideally before they move on to other tasks. Which feedback mechanism is most effective?

A company's build pipeline downloads open-source libraries from a public repository. They want to ensure that a compromised library version is not used in production builds. Which control should be added to the pipeline?

Keep studying — DevSecOps Pipelines and CI/CD Security