A team is using a CI/CD pipeline to deploy infrastructure as code to multiple cloud environments (dev, staging, production). They want to ensure that security policies are enforced consistently across all environments. Which approach is most effective?

Use the same pipeline definition for all environments, with environment-specific variables and a policy-as-code engine that validates the infrastructure against security policies before deployment.

Create separate pipelines for each environment and manually configure security checks in each one.

Use a single pipeline that deploys to all environments at once without any environment-specific controls.

Deploy to production first and then run security checks to identify issues.

An organization is adopting infrastructure as code (IaC) to manage its cloud environments. They want to ensure that security misconfigurations are caught before infrastructure is deployed. The team uses Terraform to provision resources and has a CI pipeline for the IaC code. Which control should they implement in the pipeline?

Require a manual security review of the Terraform code before every deployment.

Use a cloud security posture management (CSPM) tool that continuously monitors the production environment after deployment.

Deploy the infrastructure to a test environment and then run a vulnerability scan on the deployed resources.

Run a static analysis tool on the Terraform code to detect misconfigurations, such as open security groups or unencrypted storage, and fail the pipeline if issues are found.

Where in a CI/CD pipeline is a static application security testing (SAST) tool most appropriately integrated?

Only during the post-deployment review

Only in the production monitoring phase

During the build stage after code compilation

A team uses infrastructure as code to manage environments. They want to ensure that production environments are immutable and that any change is deployed through the pipeline, not manually. They also want to monitor for drift. Which approach best achieves this?

Use a pipeline that applies IaC changes to production, and run a periodic drift detection job that compares the actual environment to the desired state and alerts on differences.

Allow administrators to make manual changes to production and rely on the IaC tool to reconcile them automatically.

Use a configuration management tool that runs periodically to enforce the desired state, but do not integrate it with the pipeline.

Create a new environment for each deployment and decommission the old one, but do not monitor for drift.

What is the primary benefit of automating security checks in a CI/CD pipeline?

Eliminating the need for manual security reviews entirely

Guaranteeing that no vulnerabilities will be present in production

Replacing the need for compliance audits

Providing consistent and repeatable security testing on every change

EC-CouncilDevSecOps Essentials

Domain 4Objective 2

Key Elements of the DevSecOps Pipeline DSE Practice Questions (Page 3)

Part of the DevSecOps Pipelines and CI/CD Security domain, which makes up ~18% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 2–3 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

8concepts

Questions 11–15

11application · medium
A team is using a CI/CD pipeline to deploy infrastructure as code to multiple cloud environments (dev, staging, production). They want to ensure that security policies are enforced consistently across all environments. Which approach is most effective?
Select an answer first
12application · medium
An organization is adopting infrastructure as code (IaC) to manage its cloud environments. They want to ensure that security misconfigurations are caught before infrastructure is deployed. The team uses Terraform to provision resources and has a CI pipeline for the IaC code. Which control should they implement in the pipeline?
Select an answer first
13foundation · easy
Where in a CI/CD pipeline is a static application security testing (SAST) tool most appropriately integrated?
Select an answer first
14expert · hard
A team uses infrastructure as code to manage environments. They want to ensure that production environments are immutable and that any change is deployed through the pipeline, not manually. They also want to monitor for drift. Which approach best achieves this?
Select an answer first
15foundation · easy
What is the primary benefit of automating security checks in a CI/CD pipeline?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DSE” is a trademark of its owner, used for identification only.