EC-COUNCILEC-Council Certified DevSecOps Engineer
The EC-Council Certified DevSecOps Engineer (ECDE) certification validates your ability to integrate security across every stage of the DevOps lifecycle, from planning and coding to deployment and monitoring. Designed for DevSecOps engineers, this lab-intensive program covers application and infrastructure security across on-premises and cloud-native environments, including AWS, Azure, and GCP. With 70% hands-on labs and AI-powered tools, ECDE prepares you to shift security left and build resilient, compliant pipelines.
1083 practice questions · Updated 2026-07-30
6Domains
24Objectives
185Concepts
1083Questions
ECDE Curriculum
Every domain, objective, and concept the ECDE exam measures.
- DevOps Culture Principles
- DevOps vs. Traditional IT
- DevSecOps Culture
- DevOps Fundamentals
- DevOps Maturity Models
- Assessing DevOps Maturity
- CI/CD Pipeline Fundamentals
- Pipeline Stages and Components
- Pipeline Orchestration and Tools
- Pipeline as Code
- Integration with Version Control
- Artifact Management
- Deployment Strategies
- Pipeline Security and Compliance
- Shift-Left Security Definition
- Benefits of Shift-Left Security
- Integrating Security into DevOps Phases
- Cultural and Collaboration Changes
- Security as Code
- Automated Security Testing in CI/CD
- Continuous Security Monitoring
- Challenges and Best Practices
- DevSecOps Culture Principles
- Cultural Transformation Strategies
- Collaboration and Communication
- Security as a Shared Responsibility
- Metrics and Feedback Loops
- Overcoming Resistance to Change
- DevSecOps Pipeline Overview
- Pipeline Strategy Development
- Tool Selection Criteria
- Pipeline Automation and Orchestration
- Security Integration in CI/CD
- Pipeline Metrics and Monitoring
- Pipeline Security and Compliance
- Define threat modeling
- Identify threat modeling objectives
- Describe threat modeling process
- Recognize threat modeling methodologies
- Apply threat modeling in DevSecOps
- Pre-Commit Code Evaluation Overview
- Static Application Security Testing (SAST)
- Secret Detection and Management
- Dependency and Supply Chain Scanning
- Code Quality and Security Linters
- Pre-Commit Hook Implementation
- Integrating Security Tools into CI/CD
- Remediation and Feedback Loops
- Policy and Compliance Enforcement
- Performance and False Positive Management
- Repository Scanning Overview
- Static Application Security Testing (SAST)
- Dependency Scanning
- Secrets Detection
- Container Image Scanning
- Infrastructure as Code (IaC) Scanning
- Scanning Tools Integration
- Scanning Policies and Governance
- Remediation and Reporting
- Secret Management Fundamentals
- Secret Management Tools Overview
- Secret Storage and Encryption
- Secret Rotation and Lifecycle
- Integration with CI/CD Pipelines
- Secret Scanning and Detection
- Access Control and Auditing
- SCA Fundamentals
- Dependency Identification
- Vulnerability Databases
- License Compliance
- SCA Tooling
- Integration in CI/CD
- Remediation Strategies
- False Positive Management
- SBOM Generation
- SAST Definition and Purpose
- SAST vs DAST
- SAST Integration in CI/CD
- SAST Tool Capabilities
- Common SAST Tools
- SAST Limitations
- Interpreting SAST Results
- Secure Code Review Basics
- Manual vs Automated Code Review
- SAST Best Practices
- Repository Integration Methods
- SAST Tool Configuration for Repositories
- Triggering SAST Scans from Repository Events
- Handling Scan Results and Feedback Loop
- Security and Access Control in Integration
- Security by Design Principles
- Threat Modeling in Design
- Secure Architecture Patterns
- Security Requirements Definition
- Design Review for Security
- Code Review Strategy Fundamentals
- Threat Modeling for Code Review
- Manual vs. Automated Review
- Secure Code Review Checklist
- Risk-Based Prioritization
- Collaborative Review Workflow
- Integrating SAST into CI/CD
- Handling False Positives and Negatives
- Secure Code Review Metrics
- DAST Fundamentals
- DAST vs SAST vs IAST
- DAST Workflow in CI/CD
- DAST Tool Selection
- DAST Configuration and Tuning
- Interpreting DAST Results
- DAST in DevSecOps Culture
- CI/CD Pipeline Fundamentals
- Pipeline Components and Tools
- Pipeline Stages and Flow
- Integrating DAST into CI/CD
- Pipeline Security Best Practices
- Pipeline Orchestration and Automation
- Continuous Integration and Delivery Concepts
- Pipeline Monitoring and Feedback
- RASP Fundamentals
- RASP vs WAF
- RASP Integration in CI/CD
- RASP Deployment Modes
- RASP Attack Detection
- RASP Configuration and Tuning
- RASP Monitoring and Logging
- RASP Performance Impact
- RASP Incident Response
- VAPT Strategy Fundamentals
- Vulnerability Assessment vs. Penetration Testing
- VAPT Planning and Scoping
- VAPT Methodologies and Frameworks
- VAPT Tools and Techniques
- VAPT Execution and Reporting
- VAPT Integration in CI/CD
- Remediation and Retesting
- IaC Security Fundamentals
- Secure IaC Tooling
- IaC Misconfigurations
- IaC Scanning and Validation
- Secret Management in IaC
- Policy as Code
- IaC Pipeline Security
- Immutable Infrastructure
- IaC Drift Detection
- Container Security Fundamentals
- Container Image Security
- Container Runtime Security
- Container Orchestration Security
- Container Network Security
- Container Supply Chain Security
- Container Monitoring and Logging
- Container Compliance and Auditing
- Docker image creation
- Docker container lifecycle
- Container networking
- Data persistence in containers
- Container orchestration basics
- Security best practices for containers
- Monitoring container health
- Compliance as Code Fundamentals
- Policy-as-Code Frameworks
- Automated Compliance Validation
- Continuous Compliance Monitoring
- Compliance Remediation Automation
- Compliance Reporting and Auditing
- Integrating Compliance into CI/CD
- Versioning and Managing Compliance Policies
- Monitoring Fundamentals
- Logging Fundamentals
- Monitoring Tools and Technologies
- Logging Tools and Technologies
- Metrics and Alerting
- Security Monitoring
- Compliance and Audit Logging
- Incident Response and Monitoring
- Best Practices for Monitoring and Logging
- WAF Integration Fundamentals
- WAF Deployment Models
- WAF Configuration and Policy Management
- WAF Integration with CI/CD Pipeline
- WAF Monitoring and Logging
- WAF Tuning and False Positive Management
- WAF Testing and Validation
- WAF Incident Response and Remediation
Ready to practice?Test your knowledge with exam-style questions or take an intelligent quiz tailored to your level.
Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for ECDE, so none is invented.