A container image is built from a base image that includes a vulnerable package. The vulnerability is not in the application code but in the base image. The team wants to ensure that the image is not deployed with known vulnerabilities. Which action should be taken?

Remove the vulnerable package from the image using a Dockerfile RUN command.

Add a suppression rule for the vulnerability in the container scanner.

Update the base image to a patched version and rebuild the application image.

Deploy the image because the vulnerability is in the base image, not the application.

A secrets scanner flags a hardcoded AWS access key in a Git repository. The key was committed three weeks ago and has been pushed to the remote. The team wants to minimize the risk. What is the first step they should take?

Delete the key from the repository and force-push the history.

Add the key to the secrets scanner's allowlist to stop the alert.

Change the repository from public to private.

Rotate the AWS access key immediately.

A company is adopting DevSecOps and wants to introduce repository scanning. They want to ensure that security issues are found as early as possible in the development lifecycle. Which scanning approach best supports this goal?

Run SAST scans only during the release build.

Run SAST scans manually when the security team has time.

Run SAST scans only on the main branch after code is merged.

Run SAST scans on every pull request before merging.

A Python application uses a third-party library with a known critical vulnerability. The library is used only in a development tool that never runs in production. The team wants to address the finding without breaking the production build. What should they do?

Add the finding to a risk acceptance list with a justification and a remediation deadline.

Remove the library from the project entirely.

Suppress the finding because the library is not in production.

Update the library to a patched version immediately, even if it breaks the dev tool.

What is the primary purpose of generating reports from scan results?

To increase the number of false positives

To provide actionable information to developers for fixing vulnerabilities

To replace the need for security audits

To automatically fix all vulnerabilities without human intervention

EC-CouncilCertified DevSecOps Engineer

Domain 2Objective 3

Scanning Code Repositories ECDE Practice Questions (Page 5)

Part of the Plan Stage: Threat Modeling and Pre-Commit Security domain, which makes up ~19% of our current practice bank.

37questions here

8free pages

9concepts

Questions 21–25

21application · medium
A container image is built from a base image that includes a vulnerable package. The vulnerability is not in the application code but in the base image. The team wants to ensure that the image is not deployed with known vulnerabilities. Which action should be taken?
Select an answer first
22application · medium
A secrets scanner flags a hardcoded AWS access key in a Git repository. The key was committed three weeks ago and has been pushed to the remote. The team wants to minimize the risk. What is the first step they should take?
Select an answer first
23application · medium
A company is adopting DevSecOps and wants to introduce repository scanning. They want to ensure that security issues are found as early as possible in the development lifecycle. Which scanning approach best supports this goal?
Select an answer first
24application · medium
A Python application uses a third-party library with a known critical vulnerability. The library is used only in a development tool that never runs in production. The team wants to address the finding without breaking the production build. What should they do?
Select an answer first
25foundation · easy
What is the primary purpose of generating reports from scan results?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECDE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECDE” is a trademark of its owner, used for identification only.