What is the purpose of providing actionable feedback to developers on pre-commit findings?

To assign blame to developers who introduced the issue

To automatically fix all issues without developer involvement

To help developers understand and fix the identified security issues efficiently

To document the issue for compliance audits only

Which of the following is an example of a security anti-pattern that a linter might detect?

Using HTTPS for network communication

Using a parameterized query to access a database

Using the `eval()` function on user-supplied input

Validating user input before processing

A startup is building a new microservices application. They want to embed security checks as early as possible in the development lifecycle. Their developers work locally and push to a shared repository. They want to catch issues before they reach the shared repository. Which approach aligns with the DevSecOps principle of shifting security left?

Implement client-side pre-commit hooks that run SAST, secret scanning, and dependency checks on every commit.

Deploy to a staging environment and run DAST scans before production release.

Perform security reviews only during the code review process after a pull request is created.

Run security scans only in the CI pipeline after code is pushed to the shared repository.

What is a common way to report security scan results in a CI/CD pipeline?

By printing results to the console without any structured format

By sending an email to the entire organization for every finding

By storing results in a public database for anyone to view

By generating a report artifact and displaying it in the pipeline's user interface

What is the primary function of a security-focused linter in the pre-commit phase?

To measure code coverage and identify untested lines

To compile the code and check for syntax errors

To enforce coding standards and detect security anti-patterns

To run unit tests and verify functional correctness

EC-CouncilCertified DevSecOps Engineer

Domain 2Objective 2

Pre-Commit Code Evaluation ECDE Practice Questions (Page 7)

Part of the Plan Stage: Threat Modeling and Pre-Commit Security domain, which makes up ~19% of our current practice bank.

50questions here

10free pages

10concepts

Questions 31–35

31foundation · easy
What is the purpose of providing actionable feedback to developers on pre-commit findings?
Select an answer first
32foundation · easy
Which of the following is an example of a security anti-pattern that a linter might detect?
Select an answer first
33application · medium
A startup is building a new microservices application. They want to embed security checks as early as possible in the development lifecycle. Their developers work locally and push to a shared repository. They want to catch issues before they reach the shared repository. Which approach aligns with the DevSecOps principle of shifting security left?
Select an answer first
34foundation · easy
What is a common way to report security scan results in a CI/CD pipeline?
Select an answer first
35foundation · easy
What is the primary function of a security-focused linter in the pre-commit phase?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECDE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECDE” is a trademark of its owner, used for identification only.