A company is adopting DevSecOps and wants to ensure that security testing is not a bottleneck in their release process. They are considering how to incorporate VAPT into their release and deploy stage. What is the most effective strategy?

Integrate automated vulnerability scanning into the CI/CD pipeline and schedule manual penetration tests on major releases.

Perform a full manual penetration test before every release, regardless of size.

Skip VAPT entirely and rely on code reviews.

Run vulnerability scans only after deployment to production.

A security team is asked to assess a new web application. They have a limited time window and need to identify as many vulnerabilities as possible, but they do not need to prove exploitability. Which type of assessment should they perform?

Penetration testing with manual exploitation

Vulnerability assessment using automated scanners

A security analyst needs to identify known vulnerabilities in a set of Linux servers and then determine if any of those vulnerabilities could be exploited to gain root access. Which combination of tools is most appropriate?

OpenVAS for vulnerability scanning, then John the Ripper for password cracking

Nessus for vulnerability scanning, then Metasploit for exploitation attempts

Burp Suite for web application testing, then Nikto for web server scanning

Nmap for port scanning, then Wireshark for packet analysis

What is the primary purpose of a VAPT report?

To provide a detailed log of all actions taken by the penetration testers

To serve as a legal document to protect the organization from liability

To document the vulnerabilities found, their risk levels, and recommended remediation actions

To justify the budget for future security testing

EC-CouncilCertified DevSecOps Engineer

Domain 5Objective 2

VAPT Strategy ECDE Practice Questions (Page 4)

Part of the Release and Deploy Stage domain, which makes up ~14% of our current practice bank.

53questions here

11free pages

8concepts

Questions 16–20

16application · medium
A company is adopting DevSecOps and wants to ensure that security testing is not a bottleneck in their release process. They are considering how to incorporate VAPT into their release and deploy stage. What is the most effective strategy?
Select an answer first
17application · medium
A security team is asked to assess a new web application. They have a limited time window and need to identify as many vulnerabilities as possible, but they do not need to prove exploitability. Which type of assessment should they perform?
Select an answer first
18application · medium
A security analyst needs to identify known vulnerabilities in a set of Linux servers and then determine if any of those vulnerabilities could be exploited to gain root access. Which combination of tools is most appropriate?
Select an answer first
19foundation · easy
What is the primary purpose of a VAPT report?
Select an answer first
20application · medium
A penetration testing team is about to test a web application that handles financial transactions. They need a structured methodology that covers all phases from planning to reporting, and they want to align with industry best practices for web application testing. Which framework should they choose?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECDE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECDE” is a trademark of its owner, used for identification only.