What is the purpose of scanning Infrastructure as Code (IaC) templates?

To detect secrets in the IaC templates

To identify security misconfigurations in the infrastructure that will be provisioned

To analyze the application source code for vulnerabilities

To ensure the IaC templates are syntactically correct

Which of the following is an example of a security issue that IaC scanning can detect?

A security group rule that allows SSH access from any IP address

A missing feature in the user interface

A database password hardcoded in the Terraform configuration

A bug in the application's login logic

A development team is experiencing a high rate of false positives from their SAST tool, which is causing developers to ignore the results. The security team wants to reduce the noise while maintaining security coverage. Which approach is most effective?

Tune the SAST tool's rules and configurations to reduce false positives.

Disable the SAST tool and rely on manual code review.

Increase the severity threshold to only report critical issues.

Have developers manually triage each finding and mark false positives.

Which of the following is a characteristic of SAST tools?

They are only effective after the application is fully deployed

They only detect vulnerabilities in third-party libraries

They require a running application and valid credentials to test

They can identify vulnerabilities early in the development process without needing a deployed environment

What is the main goal of secrets detection in code repositories?

To find hardcoded credentials, API keys, and other sensitive data that should not be committed

To ensure that the repository is encrypted at rest

To identify vulnerabilities in third-party libraries

To analyze the code for logic errors and bugs

EC-CouncilCertified DevSecOps Engineer

Domain 2Objective 3

Scanning Code Repositories ECDE Practice Questions (Page 2)

Part of the Plan Stage: Threat Modeling and Pre-Commit Security domain, which makes up ~19% of our current practice bank.

37questions here

8free pages

9concepts

Questions 6–10

6foundation · easy
What is the purpose of scanning Infrastructure as Code (IaC) templates?
Select an answer first
7foundation · easy
Which of the following is an example of a security issue that IaC scanning can detect?
Select an answer first
8expert · hard
A development team is experiencing a high rate of false positives from their SAST tool, which is causing developers to ignore the results. The security team wants to reduce the noise while maintaining security coverage. Which approach is most effective?
Select an answer first
9foundation · easy
Which of the following is a characteristic of SAST tools?
Select an answer first
10foundation · easy
What is the main goal of secrets detection in code repositories?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECDE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECDE” is a trademark of its owner, used for identification only.