In a DevSecOps pipeline, which activity is directly supported by source-code management?

Running unit tests after every commit

Tracking who changed which lines of code and when

Monitoring application performance in production

Packaging the application into a container image

A developer accidentally committed a database password to a public GitHub repository. The password is now visible in the commit history. The team wants to remove the password from the repository and prevent it from being used. Which set of actions should be taken?

Add the file to `.gitignore` and commit the change.

Delete the file from the latest commit and force-push the branch to overwrite history.

Use `git filter-repo` to remove the file from history, force-push all branches, and then rotate the database password.

Change the file's permissions to private and commit the change.

What is the primary role of a build tool in a software project?

Sending notifications to developers on code changes

Managing the source code version history

Automating the compilation and packaging of source code into artifacts

Monitoring application performance in production

A team uses Maven to build a Java project. They want to ensure that the build fails if any dependency has a known security vulnerability. They also want to generate a software bill of materials (SBOM) for each build. What should they add to their build configuration?

Add the OWASP Dependency-Check plugin and the CycloneDX Maven plugin to the build.

Configure the Maven Surefire plugin to run more tests.

Use the Maven compiler plugin with verbose output.

Set the Maven `-X` flag to enable debug logging.

What is a key feature of repository hosting platforms like GitHub, GitLab, or Bitbucket that supports team collaboration?

Built-in production deployment for any application

Guaranteed protection from all security vulnerabilities

Automatic code compilation without configuration

Pull requests and code review workflows

EC-CouncilDevSecOps Essentials

Domain 3Objective 2

Source-Code Management and Build Tools DSE Practice Questions (Page 7)

Part of the DevSecOps Toolchain domain, which makes up ~19% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 2–3 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

10concepts

Questions 31–35

31foundation · easy
In a DevSecOps pipeline, which activity is directly supported by source-code management?
Select an answer first
32application · medium
A developer accidentally committed a database password to a public GitHub repository. The password is now visible in the commit history. The team wants to remove the password from the repository and prevent it from being used. Which set of actions should be taken?
Select an answer first
33foundation · easy
What is the primary role of a build tool in a software project?
Select an answer first
34application · medium
A team uses Maven to build a Java project. They want to ensure that the build fails if any dependency has a known security vulnerability. They also want to generate a software bill of materials (SBOM) for each build. What should they add to their build configuration?
Select an answer first
35foundation · easy
What is a key feature of repository hosting platforms like GitHub, GitLab, or Bitbucket that supports team collaboration?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DSE” is a trademark of its owner, used for identification only.