Which of the following is a common way to integrate a SAST tool into a repository workflow?

Manually running the SAST tool once a year during an audit

Running the SAST tool as a pre-commit hook or a CI pipeline step

Deploying the application to production and then scanning it

Using the SAST tool only on the final release branch

When prioritizing scan findings, which factor is most important to consider?

The severity of the vulnerability and its exploitability

The developer's seniority who wrote the code

The number of lines of code in the file where the issue was found

The order in which the findings were reported

Which of the following is an example of a scanning governance policy?

Requiring that all critical vulnerabilities be remediated within 48 hours

Setting the number of commits allowed per day

Deciding which IDE developers should use

Choosing the color scheme for the security dashboard

Which of the following is a common finding that container image scanning can detect?

A logic error in the application's business rules

A vulnerability in a system library installed in the base image

A missing feature in the application's user interface

A performance bottleneck in the application's database queries

What is the primary purpose of scanning code repositories in a DevSecOps pipeline?

To replace the need for manual code reviews by developers

To ensure that the code repository is accessible only to authorized developers

To automatically deploy code changes to production without manual review

To identify security issues early in the software development lifecycle before they reach production

EC-CouncilCertified DevSecOps Engineer

Domain 2Objective 3

Scanning Code Repositories ECDE Practice Questions (Page 3)

Part of the Plan Stage: Threat Modeling and Pre-Commit Security domain, which makes up ~19% of our current practice bank.

37questions here

8free pages

9concepts

Questions 11–15

11foundation · easy
Which of the following is a common way to integrate a SAST tool into a repository workflow?
Select an answer first
12foundation · easy
When prioritizing scan findings, which factor is most important to consider?
Select an answer first
13foundation · easy
Which of the following is an example of a scanning governance policy?
Select an answer first
14foundation · easy
Which of the following is a common finding that container image scanning can detect?
Select an answer first
15foundation · easy
What is the primary purpose of scanning code repositories in a DevSecOps pipeline?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECDE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECDE” is a trademark of its owner, used for identification only.