A developer pushes a commit that accidentally includes a database password in a configuration file. The commit is merged before the mistake is noticed. The team uses GitHub Actions for CI/CD and wants to prevent this from happening again. Which approach should the team implement?

Configure a GitHub Actions workflow that runs a secret scanner on every pull request and fails the build if a secret is detected.

Implement a pre-commit hook, a CI scanner on pull requests, and rotate the leaked password.

Use GitHub secret scanning to detect the leaked password and then rotate the database password immediately.

Add a pre-commit hook that scans staged files for known secret patterns and blocks the commit if any are found.

Which of the following is an example of a fine-grained access policy for a secret management system?

Granting a specific application read-only access to only the database credentials it needs

Denying all access to secrets for everyone

Allowing all developers to read all secrets

Granting administrators full access to all secrets

What is the primary purpose of secret scanning tools in a DevSecOps pipeline?

To detect hardcoded secrets in source code and prevent them from being committed

To rotate secrets automatically

To encrypt secrets before they are stored in the repository

What is the primary purpose of secret rotation in a DevSecOps environment?

To make secrets easier to remember for developers

To increase the number of secrets available for use

To reduce the risk of compromised secrets by regularly replacing them with new ones

To comply with data retention laws

A development team wants to prevent hardcoded secrets from being committed to their Git repository. They use GitHub. What is the most effective way to implement this control?

Use a code review process where a human checks every commit for secrets.

Add a pre-commit hook that runs a regex search for common secret patterns.

Enable GitHub secret scanning and push protection for the repository.

Set the repository to private so that any committed secrets are not publicly exposed.

EC-CouncilCertified DevSecOps Engineer

Domain 2Objective 4

Secret Management Tools ECDE Practice Questions (Page 2)

Part of the Plan Stage: Threat Modeling and Pre-Commit Security domain, which makes up ~19% of our current practice bank.

44questions here

9free pages

7concepts

Questions 6–10

6application · medium
A developer pushes a commit that accidentally includes a database password in a configuration file. The commit is merged before the mistake is noticed. The team uses GitHub Actions for CI/CD and wants to prevent this from happening again. Which approach should the team implement?
Select an answer first
7foundation · easy
Which of the following is an example of a fine-grained access policy for a secret management system?
Select an answer first
8foundation · easy
What is the primary purpose of secret scanning tools in a DevSecOps pipeline?
Select an answer first
9foundation · easy
What is the primary purpose of secret rotation in a DevSecOps environment?
Select an answer first
10application · medium
A development team wants to prevent hardcoded secrets from being committed to their Git repository. They use GitHub. What is the most effective way to implement this control?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECDE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECDE” is a trademark of its owner, used for identification only.