How does Static Application Security Testing (SAST) analyze source code for vulnerabilities?

By examining the source code, bytecode, or binary without executing it

By monitoring network traffic to and from the application

By scanning the container image for known vulnerability signatures

By executing the application and sending malicious inputs to observe runtime behavior

A team builds a container image for a web application. They want to scan the image for vulnerabilities before pushing it to the registry. The CI pipeline currently builds the image and pushes it directly. What should they add to the pipeline?

Run a container image scan after the build and before the push, failing the pipeline on critical findings.

Scan the base image only, not the final image.

Use the registry's built-in scan feature after the image is pushed.

Run the scan after the push and alert the team of any findings.

What is the primary purpose of dependency scanning in a code repository?

To analyze the application's own source code for logic flaws

To identify known vulnerabilities in third-party libraries and packages used by the application

To detect hardcoded passwords and API keys in the source code

To ensure that all dependencies are open-source and free to use

What is the primary purpose of container image scanning?

To identify known vulnerabilities and misconfigurations in the image layers and packages

To analyze the source code of the application inside the container

To detect hardcoded secrets in the container's environment variables

To ensure the container image is small in size

In a DevSecOps pipeline, repository scanning is typically performed at which stage?

During the build and commit phases, before deployment

Only during annual security audits

Only when a security incident occurs

EC-CouncilCertified DevSecOps Engineer

Domain 2Objective 3

Scanning Code Repositories ECDE Practice Questions (Page 4)

Part of the Plan Stage: Threat Modeling and Pre-Commit Security domain, which makes up ~19% of our current practice bank.

37questions here

8free pages

9concepts

Questions 16–20

16foundation · easy
How does Static Application Security Testing (SAST) analyze source code for vulnerabilities?
Select an answer first
17application · medium
A team builds a container image for a web application. They want to scan the image for vulnerabilities before pushing it to the registry. The CI pipeline currently builds the image and pushes it directly. What should they add to the pipeline?
Select an answer first
18foundation · easy
What is the primary purpose of dependency scanning in a code repository?
Select an answer first
19foundation · easy
What is the primary purpose of container image scanning?
Select an answer first
20foundation · easy
In a DevSecOps pipeline, repository scanning is typically performed at which stage?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECDE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECDE” is a trademark of its owner, used for identification only.