312-97 Exam Dumps - EC-Council Certified DevSecOps Engineer (ECDE)

Dynamic Application Security Testing (DAST) and fuzz testing require a running application in order to actively probe for vulnerabilities such as injection flaws, authentication bypasses, and improper input handling. These techniques are therefore performed after the application has been built and deployed to a testing environment, categorizing them astest-time checks. Commit-time and build-time checks rely primarily on static analysis and dependency scanning and do not exercise application behavior at runtime. Deploy-time checks focus on configuration validation rather than aggressive attack simulation. Test-time checks are specifically designed to uncover critical and high-severity vulnerabilities by mimicking real-world attack scenarios. Performing DAST and fuzz testing during this stage allows teams to detect exploitable flaws before production release, significantly strengthening application security.

========

Retire.js is a Software Composition Analysis (SCA) tool designed specifically to identify known vulnerabilities in JavaScript libraries used in web and NodeJS applications. It scans dependencies and compares detected versions against a vulnerability database to identify insecure libraries. Bandit is a static analysis tool for Python, Bundler-Audit is used for Ruby dependencies, and Tenable.io focuses on infrastructure and vulnerability management rather than JavaScript libraries. Using Retire.js during the Code stage allows DevSecOps teams to identify insecure third-party dependencies early, reducing the likelihood of vulnerable libraries being deployed into production. This supports shift-left security and strengthens the application’s overall security posture.

========

The pytm framework generates threat models that can be visualized using PlantUML diagrams. To create asequence diagram, the --seq option is used with the model file, and the output is piped to the PlantUML processor. The correct command must reference the correct Java system property -Djava.awt.headless=true, which allows diagram rendering in environments without a graphical interface, such as CI/CD pipelines. Additionally, the correct jar file name is plantuml.jar. Options using lowercase -d instead of uppercase -D are invalid, and commands referencing plantum.jar are incorrect due to a misspelled jar name. Generating sequence diagrams during the Plan stage helps DevSecOps teams visualize data flows, understand attacker paths, and identify security threats early in the application design phase.

========

Kubernetes clusters are managed and inspected using the kubectl command-line tool. To verify whether a Kubernetes cluster is functioning correctly, administrators commonly run kubectl version to confirm that both the client and server components are reachable and operational. This is followed by kubectl cluster-info, which displays information about the cluster’s control plane and core services. These commands together confirm API server availability, cluster connectivity, and basic health status. The other options list invalid command names such as kube, kubernetes, or kube-etcd, which are not used for standard cluster validation. Performing these checks during the Operate and Monitor stage helps quickly identify whether application issues stem from cluster-level problems or application-level misconfigurations. This supports faster troubleshooting and more reliable production operations.

========

To complete Azure Key Vault integration with Jenkins, Kevin must createnew credentialsin Jenkins underGlobal Credentials (unrestricted). These credentials store the Azure client ID, client secret, tenant ID, and subscription details required by the Azure Key Vault plugin to authenticate securely. Modifying old credentials can lead to misconfiguration or credential reuse risks, while restricted credentials may prevent the plugin from accessing secrets across pipelines. Creating new unrestricted credentials ensures proper authentication and controlled access to secrets during the Code stage, supporting secure secret management across CI/CD workflows.

Runtime Application Self-Protection (RASP) operates from within the application runtime environment, monitoring incoming traffic, API calls, and execution behavior in real time. Because it has deep visibility into application logic and execution context, RASP can accurately detect attacks such as injection, tampering, and abnormal behavior while minimizing false positives. SAST analyzes source code statically, DAST tests running applications externally, and IAST combines some runtime insight with testing but does not actively block threats. RASP’s ability to detect and remediate attacks during runtime makes it ideal for protecting applications in production environments, aligning with the Operate and Monitor stage of the DevSecOps pipeline.

If a pre-commit hook script does not explicitly detect sensitive information or return a non-zero exit code, Git will treat the hook execution as successful. In this scenario, although the hook was made executable, Beth still managed to commit sensitive information. This implies that the hook either did not contain logic to detect such data or did not fail the commit upon detection. As a result, the script exited with0, allowing the commit to proceed. Exit code 0 always signals success to Git, while non-zero exit codes block commits. This highlights the importance of properly implementing security checks within hooks, not just enabling them. Making a hook executable is necessary, but it must also include correct validation logic to enforce security policies during the Code stage.

========

Azure Container Instances (ACI) exposes container logs via the Azure CLI using the az container logs command. To retrieve logs, you must provide the resource group and the container group name using the long-form parameters --resource-group and --name. Option A matches the correct CLI structure and parameter format: az container logs --resource-group ACI --name aci-test-closh. Options B and D incorrectly use single-dash forms (-resource-group and -name), which are not valid for these long option names. Options C and D incorrectly use azure instead of az; the Azure CLI command group is invoked with az, not azure. Getting logs after deployment review is a critical Operate and Monitor activity: it helps confirm the container started correctly, diagnose runtime errors, and validate that runtime protection (such as a RASP/micro-agent) is functioning. This visibility supports faster incident response and helps ensure the containerized workload remains secure and stable in its runtime environment.

========