A team wants to use production security monitoring data to improve their CI/CD pipeline. They notice that a specific vulnerability class appears frequently in production but is not caught by their current SAST rules. They want to update the pipeline to catch this class earlier. Which approach best uses the feedback loop?

Ignore the production data and continue with the current SAST rules.

Add more DAST scans in production to catch the issue later.

Increase the frequency of production monitoring alerts.

Analyze the production findings to identify the root cause, then add or tune SAST rules to detect that vulnerability class in the pipeline.

A team is implementing a CI/CD pipeline and wants to ensure that only authorized personnel can approve and deploy releases to production. Which control is most effective?

Disable all approval gates to avoid delays.

Allow any developer to approve and deploy to production to speed up releases.

Configure role-based access control (RBAC) on the pipeline so only designated users can approve production deployments.

Use a shared password for the deployment account so everyone can deploy.

A team wants to catch SQL injection and cross-site scripting flaws in their custom application code before the code is merged. Which automated security testing technique should be integrated into the pipeline at the commit stage?

Run a Dynamic Application Security Testing (DAST) tool against the production environment.

Run a Static Application Security Testing (SAST) tool that analyzes source code for known vulnerability patterns.

Run an interactive application security testing (IAST) tool only in the production environment.

Run a software composition analysis (SCA) tool to check for known vulnerabilities in open-source libraries.

A company must comply with a regulation that requires all production code changes to be traceable to a work item and approved by a manager. They also want to allow developers to deploy quickly. Which pipeline configuration best satisfies both the compliance requirement and the need for speed?

Enforce that each commit references a work item ID, and require manager approval only for the production deployment stage.

Use a single shared manager account to approve all deployments.

Require manager approval for every commit and every deployment stage.

Allow developers to deploy without any approval and log all changes.

A team wants to automatically detect known vulnerabilities in third-party libraries used by their application. Which tool should they integrate into their CI pipeline?

Dynamic application security testing (DAST) tool.

Static application security testing (SAST) tool.

Dependency scanning tool (e.g., OWASP Dependency-Check, Snyk).

Runtime application self-protection (RASP) tool.

EC-CouncilDevSecOps Essentials

Domain 4Objective 1

Role of DevSecOps in the CI/CD Pipeline DSE Practice Questions (Page 3)

Part of the DevSecOps Pipelines and CI/CD Security domain, which makes up ~18% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 2–3 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

7concepts

Questions 11–15

11expert · hard
A team wants to use production security monitoring data to improve their CI/CD pipeline. They notice that a specific vulnerability class appears frequently in production but is not caught by their current SAST rules. They want to update the pipeline to catch this class earlier. Which approach best uses the feedback loop?
Select an answer first
12application · medium
A team is implementing a CI/CD pipeline and wants to ensure that only authorized personnel can approve and deploy releases to production. Which control is most effective?
Select an answer first
13application · medium
A team wants to catch SQL injection and cross-site scripting flaws in their custom application code before the code is merged. Which automated security testing technique should be integrated into the pipeline at the commit stage?
Select an answer first
14expert · hard
A company must comply with a regulation that requires all production code changes to be traceable to a work item and approved by a manager. They also want to allow developers to deploy quickly. Which pipeline configuration best satisfies both the compliance requirement and the need for speed?
Select an answer first
15application · medium
A team wants to automatically detect known vulnerabilities in third-party libraries used by their application. Which tool should they integrate into their CI pipeline?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DSE” is a trademark of its owner, used for identification only.