A company has a large legacy application with many outdated dependencies. A dependency scan reveals hundreds of vulnerabilities, but the team has limited resources to fix them. The application is internet-facing. What is the most effective prioritization strategy?

Fix vulnerabilities in the order they were discovered.

Fix all vulnerabilities with a CVSS score of 9.0 or higher.

Upgrade all dependencies to the latest versions.

Prioritize vulnerabilities that are actively exploited in the wild and affect components that are reachable from the internet.

A SAST scan reports 50 findings. The team has limited time to fix them before a release. They want to prioritize the most important issues. Which factor should they consider first?

The age of the code where the finding is located.

The developer who wrote the code.

The severity and exploitability of each finding.

The number of findings in each file.

Which of the following is a typical method used by secrets detection tools to identify secrets?

Matching patterns and entropy analysis to find strings that resemble keys or tokens

Scanning the container image for malicious binaries

Checking the code against a database of known malware signatures

Executing the code and observing network requests for credentials

EC-CouncilCertified DevSecOps Engineer

Domain 2Objective 3

Scanning Code Repositories ECDE Practice Questions (Page 6)

Part of the Plan Stage: Threat Modeling and Pre-Commit Security domain, which makes up ~19% of our current practice bank.

37questions here

8free pages

9concepts

Questions 26–30

26application · medium
A team uses Terraform to provision cloud infrastructure. They want to scan their Terraform templates for security misconfigurations before applying changes. Which tool is specifically designed for this purpose?
Select an answer first
27expert · hard
A company has a large legacy application with many outdated dependencies. A dependency scan reveals hundreds of vulnerabilities, but the team has limited resources to fix them. The application is internet-facing. What is the most effective prioritization strategy?
Select an answer first
28application · medium
A SAST scan reports 50 findings. The team has limited time to fix them before a release. They want to prioritize the most important issues. Which factor should they consider first?
Select an answer first
29application · medium
A team uses Kubernetes manifests stored in a Git repository. They want to scan these manifests for security misconfigurations before deployment. Which tool is best suited for this?
Select an answer first
30foundation · easy
Which of the following is a typical method used by secrets detection tools to identify secrets?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECDE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECDE” is a trademark of its owner, used for identification only.

Scanning Code Repositories ECDE Practice Questions (Page 6)

Questions 26–30

A team uses Terraform to provision cloud infrastructure. They want to scan their Terraform templates for security misconfigurations before applying changes. Which tool is specifically designed for this purpose?

A company has a large legacy application with many outdated dependencies. A dependency scan reveals hundreds of vulnerabilities, but the team has limited resources to fix them. The application is internet-facing. What is the most effective prioritization strategy?

A SAST scan reports 50 findings. The team has limited time to fix them before a release. They want to prioritize the most important issues. Which factor should they consider first?

A team uses Kubernetes manifests stored in a Git repository. They want to scan these manifests for security misconfigurations before deployment. Which tool is best suited for this?

Which of the following is a typical method used by secrets detection tools to identify secrets?

Keep studying — Plan Stage: Threat Modeling and Pre-Commit Security