New 312-97 Test Materials & Valid 312-97 Test Engine
312-97 Updated Exam Dumps [2026] Practice Valid Exam Dumps Question
ECCouncil 312-97 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
NEW QUESTION # 40
(Nicholas Cascone has recently been recruited by an IT company from his college as a DevSecOps engineer.
His team leader asked him to integrate GitHub Webhooks with Jenkins. To integrate GitHub Webhooks with Jenkins, Nicholas logged in to GitHub account; he then selected Settings > Webhooks > Add Webhook. In the Payload URL field, he is supposed to add Jenkins URL. Which of the following is the final Jenkins URL format that Nicholas should add in Payload URL field of GitHub to configure GitHub Webhooks with Jenkins?.)
- A. http://address:port/GitHub.webhook/.
- B. http://address:port/github_webhook/.
- C. http://address:port/GiHhub-webhook/.
- D. http://address:port/github-webhook/.
Answer: D
Explanation:
Jenkins exposes a predefined endpoint for receiving GitHub webhook events. This endpoint is /github- webhook/ and must be appended to the Jenkins base URL in the GitHub webhook configuration. Option C correctly matches the required endpoint format. The other options use incorrect casing, separators, or naming conventions that Jenkins does not recognize. Correct webhook configuration ensures that Jenkins jobs are automatically triggered when code changes occur in GitHub repositories. This integration supports continuous integration and immediate feedback during the Code stage of the DevSecOps pipeline.
========
NEW QUESTION # 41
(SNF Pvt. Ltd. is a software development company located in Denver, Colorado. The organization is using pytm, which is a Pythonic Framework for threat modeling, to detect security issues and mitigate them in advance. James Harden has been working as a DevSecOps engineer at SNF Pvt. Ltd. for the past 3 years. He has created a tm.py file that describes an application in which the user logs the app and posts the comments on the applications. These comments are stored by the application server in the database and AWS lambda cleans the database. Which of the following command James can use to generate a sequence diagram?)
- A. tm.py --seq | java -Djava.awt.headless=true -jar plantuml.jar -tpng -pipe > seq.png.
- B. tm.py --seq | java -Djava.awt.headless=true -jar plantum.jar -tpng -pipe > seq.png.
- C. tm.py --seq | java -djava.awt.headless=true -jar plantuml.jar -tpng -pipe > seq.png.
- D. tm.py --seq | java -djava.awt.headless=true -jar plantum.jar -tpng -pipe > seq.png.
Answer: A
Explanation:
The pytm framework generates threat models that can be visualized using PlantUML diagrams. To create a sequence diagram, the --seq option is used with the model file, and the output is piped to the PlantUML processor. The correct command must reference the correct Java system property -Djava.awt.headless=true, which allows diagram rendering in environments without a graphical interface, such as CI/CD pipelines.
Additionally, the correct jar file name is plantuml.jar. Options using lowercase -d instead of uppercase -D are invalid, and commands referencing plantum.jar are incorrect due to a misspelled jar name. Generating sequence diagrams during the Plan stage helps DevSecOps teams visualize data flows, understand attacker paths, and identify security threats early in the application design phase.
========
NEW QUESTION # 42
(Peter Dinklage has been working as a senior DevSecOps engineer at SacramentSoft Solution Pvt. Ltd. He has deployed applications in docker containers. His team leader asked him to check the exposure of unnecessary ports. Which of the following commands should Peter use to check all the containers and the exposed ports?)
- A. docker ps --quiet | xargs docker inspect --format : Ports.
- B. docker ps --quiet | xargs docker inspect --all --format : Ports=.
- C. docker ps --quiet | xargs docker inspect --format ': Ports='.
- D. docker ps --quiet | xargs docker inspect --all --format ': Ports='.
Answer: C
Explanation:
To inspect exposed ports for running Docker containers, the recommended approach is to first retrieve container IDs using docker ps --quiet and then pass them to docker inspect. The --format option allows selective output of container configuration details, including port mappings. The command docker ps --quiet | xargs docker inspect --format ': Ports=' correctly extracts port information for each container. Options that include the --all flag or incorrect formatting are not valid for this inspection use case. Checking exposed ports is an important activity in the Operate and Monitor stage because unnecessary open ports increase the attack surface and may violate container security best practices. Regular inspection helps ensure that only required ports are exposed, supporting secure runtime operations.
========
NEW QUESTION # 43
(William Scott, after completing his graduation in computer science, joined an IT company as a DevSecOps engineer. His team leader has asked him to use GitHub Code Scanning for evaluating the source code in his organization's GitHub repository to detect security issues and coding errors. How can William set up coding scanning in GitHub repository?)
- A. By using OWASP ZAP.
- B. By using Gauntlt.
- C. By using GitMiner.
- D. By using CodeQL.
Answer: D
Explanation:
GitHub Code Scanning is a built-in security capability designed to automatically analyze source code for security vulnerabilities and coding errors. The primary and officially supported engine for GitHub Code Scanning isCodeQL. CodeQL works by converting source code into a database and running security queries to detect issues such as injection flaws, insecure coding patterns, and logic errors. William can enable CodeQL by configuring GitHub Actions with either the default or advanced CodeQL workflow. Once enabled, CodeQL scans are triggered on events such as code pushes and pull requests, and the results appear as code scanning alerts in the repository's Security tab. Gauntlt is a security testing harness used mainly for infrastructure and application testing, GitMiner is used to discover sensitive data like secrets in repositories, and OWASP ZAP is a dynamic application security testing tool used against running applications. None of these tools configure GitHub's native Code Scanning feature. Therefore, CodeQL is the correct tool to set up GitHub Code Scanning in the Code stage of a DevSecOps pipeline.
========
NEW QUESTION # 44
(Rachel McAdams applied for the position of DevSecOps engineer at TetraSoft Pvt. Ltd. She gave her interview on February 23, 2022, and was selected as a DevSecOps engineer. Her team is working on securing Ruby on Rails application. Rachel's team leader asked her to integrate Brakeman SAST tool with Jenkins. To perform the integration, she navigated to Jenkins Plugin Manager and installed Warnings Next Generation Plugin. To run the tool in Jenkins, she invoked Brakeman as part of an Execute shell build step. In the Execute shell column, she wrote the following commands with brakeman options bash -l -c ' rvm install 3.0.0 && \ rvm use 3.0.0@brakeman -create && \ gem install brakeman && \ brakeman -no-progress -no-pager -no-exit-on-warn -o brakeman-output.json What is the function of the -no-exit-on-warn option in the above-mentioned command?)
- A. It tells Brakeman to return a 1 exit code even if warnings are found.
- B. It tells Brakeman to return a 2 exit code even if warnings are found.
- C. It tells Brakeman to return a 3 exit code even if warnings are found.
- D. It tells Brakeman to return a 0 exit code even if warnings are found.
Answer: D
Explanation:
By default, Brakeman returns a non-zero exit code when security warnings are detected, which can cause Jenkins builds to fail. The --no-exit-on-warn option modifies this behavior by instructing Brakeman toreturn an exit code of 0 even if warnings are found. This allows the CI pipeline to continue executing while still generating a security report that highlights vulnerabilities. This option is particularly useful when teams are initially integrating SAST tools and want visibility into security issues without immediately blocking builds.
During the Build and Test stage, this approach supports gradual adoption of security enforcement, allowing teams to prioritize remediation efforts while maintaining delivery velocity. Over time, organizations can tighten policies by removing this option to enforce stricter build-breaking behavior once security baselines improve.
NEW QUESTION # 45
(Debra Aniston has recently joined an MNC company as a DevSecOps engineer. Her organization develops various types of software products and web applications. The DevSecOps team leader provided an application code and asked Debra to detect and mitigate security issues. Debra used w3af tool and detected cross-site scripting and SQL injection vulnerability in the source code. Based on this information, which category of security testing tools is represented by w3af?.)
- A. DAST.
- B. SCA.
- C. SAST.
- D. IAST.
Answer: A
Explanation:
w3af (Web Application Attack and Audit Framework) is aDynamic Application Security Testing (DAST) tool. It analyzes running web applications by sending crafted requests and observing responses to identify vulnerabilities such as SQL injection, cross-site scripting, and authentication flaws. Unlike SAST tools, w3af does not require access to source code and instead operates externally, simulating real-world attack behavior.
SCA focuses on third-party dependencies, and IAST requires runtime instrumentation within the application.
Since Debra detected vulnerabilities by actively interacting with the application, w3af clearly represents DAST. DAST tools are especially valuable during the Build and Test stage, as they validate application behavior from an attacker's perspective before deployment.
========
NEW QUESTION # 46
(Michael Rady recently joined an IT company as a DevSecOps engineer. His organization develops software products and web applications related to online marketing. Michael deployed a web application on Apache server. He would like to safeguard the deployed application from diverse types of web attacks by deploying ModSecurity WAF on Apache server. Which of the following command should Michael run to install ModSecurity WAF?)
- A. sudo apt install libapache2-mod-security2 -z.
- B. sudo apt install libapache2-mod-security2 -w.
- C. sudo apt install libapache2-mod-security2 -x.
- D. sudo apt install libapache2-mod-security2 -y.
Answer: D
Explanation:
On Debian- and Ubuntu-based systems, ModSecurity for Apache is installed using the package libapache2- mod-security2. The correct command to install this package is sudo apt install libapache2-mod-security2 -y, where the -y flag automatically confirms installation prompts. The other options include invalid flags that are not recognized by the package manager and would result in command failure. Installing ModSecurity during the Operate and Monitor stage provides an additional layer of defense by inspecting incoming HTTP requests and blocking malicious traffic such as SQL injection, cross-site scripting, and protocol violations. A Web Application Firewall helps protect deployed applications from common attack vectors and supports defense- in-depth strategies in production environments.
NEW QUESTION # 47
(Andrew Gerrard has recently joined an IT company located in Fairmont, California, as a DevSecOps engineer. Due to robust security and cost-effective service provided by AWS, his organization has migrated all the workloads from on-prem to AWS cloud in January of 2020. Andrew's team leader has asked him to integrate AWS Secret Manager with Jenkins. To do so, Andrew installed the "AWS Secret Manager Credentials provider" plugin in Jenkins and configured an IAM policy in AWS that allows Jenkins to take secrets from AWS Secret manager. Which of the following file should Andrew edit to add access id and secret key parameters along with the region copied from AWS?.)
- A. /etc/filebeat/filebeat.yml.
- B. /etc/sysconfig/Jenkins.
- C. /etc/file/Jenkins.
- D. /etc/sysconfig file/Jenkins.
Answer: B
Explanation:
On Linux systems, Jenkins environment variables such as AWS access key ID, secret access key, and default region are commonly configured in the /etc/sysconfig/Jenkins file. This file allows administrators to define environment variables that are loaded when the Jenkins service starts. By placing AWS credentials and region information in this file, Jenkins jobs and plugins-such as the AWS Secrets Manager Credentials Provider- can securely access AWS resources. The other options reference invalid paths or unrelated configuration files (such as Filebeat). Editing /etc/sysconfig/Jenkins ensures consistent credential availability across Jenkins jobs while supporting secure integration with AWS services during the Code stage.
NEW QUESTION # 48
(Evan Peters has been working as a DevSecOps engineer in an IT company located in Denver, Colorado. His organization has deployed various applications on Docker containers. Evan has been running SSH service inside the containers, and handling of SSH keys and access policies is a major security concern for him. What will be the solution for Evan security concern?)
- A. Run SSH on the docker build and utilize docker exec for interacting with the container.
- B. Run SSH on the host and utilize docker exec for interacting with the container.
- C. Run SSH on the client and utilize docker exec for interacting with the container.
- D. Run SSH on the registry and utilize docker exec for interacting with the container.
Answer: B
Explanation:
Running an SSH service inside Docker containers is considered a security anti-pattern because it increases the attack surface and complicates key and access management. Containers are designed to run a single primary process and be managed externally rather than accessed via SSH. The recommended solution is torun SSH on the host systemand use docker exec to interact with containers when administrative access is required.
This approach eliminates the need to manage SSH keys inside containers, reduces exposure to brute-force attacks, and simplifies access control. The other options incorrectly suggest running SSH in inappropriate locations such as the registry, client, or build process, which do not address the core security concern. During the Operate and Monitor stage, minimizing unnecessary services within containers is critical to enforcing least privilege and maintaining a secure runtime environment.
========
NEW QUESTION # 49
(Sandra Oliver joined SinClare Soft Pvt. Ltd. as a DevSecOps engineer in January of 2010. Her organization develops software and web applications related to the healthcare industry. Using IAST runtime security testing technology, she is detecting and diagnosing security issues in applications and APIs. The IAST solution used by Sandra encompasses a web scanner with an agent that works inside the server that hosts the application to provide additional analysis details such as the location of the vulnerability in the application code. Based on the given information, which of the following IAST solutions is Sandra using?)
- A. Semi-passive IAST.
- B. Semi-active IAST.
- C. Active IAST.
- D. Passive IAST.
Answer: B
Explanation:
Interactive Application Security Testing (IAST) solutions are classified based on how they interact with the application and runtime environment. In this scenario, the solution uses aweb scannerto actively send requests to the application while also deploying anagent inside the application serverto observe runtime behavior and map vulnerabilities directly to source code locations. This combined approach is known assemi- active IAST. It is considered "semi-active" because it actively drives traffic through the application using a scanner, while the agent passively observes execution paths, data flows, and method calls. Passive IAST solutions rely only on observing existing traffic and do not use scanners, while active IAST solutions do not typically rely on deep runtime agents in the same manner. Semi-active IAST significantly reduces false positives and provides precise remediation details, making it highly effective during the Build and Test stage, where applications are actively exercised and security issues can be identified and fixed before release.
========
NEW QUESTION # 50
(Trevor Noah has been working as a DevSecOps engineer in an IT company located in Detroit, Michigan. His team leader asked him to perform continuous threat modeling using ThreatSpec. To do so, Trevor installed and initialized ThreatSpec in the source code repository; he then started annotating the source code with security issues, actions, or concept. Trevor ran ThreatSpec against the application code and he wants to generate the threat model report. Which of the following command Trevor should use to generate the threat model report using ThreatSpec?.)
- A. $ ThreatSpec Report.
- B. $ ThreatSpec report.
- C. $ threatspec report.
- D. $ Threatspec Report.
Answer: C
Explanation:
ThreatSpec is a command-line tool that follows standard Unix-style conventions, where commands are lowercase. To generate a threat model report after annotating source code, the correct command is threatspec report. Commands using incorrect casing or capitalization will fail because the CLI is case-sensitive. Options A, B, and C incorrectly capitalize either the command or the subcommand. Generating threat model reports during the Plan stage allows DevSecOps teams to continuously identify, document, and visualize security threats as the code evolves. This practice embeds threat modeling directly into the development lifecycle, enabling early risk identification and more secure system design decisions.
========
NEW QUESTION # 51
(BVR Pvt. Ltd. is an IT company that develops software products and applications related to IoT devices. The software development team of the organization is using Bitbucket repository to plan projects, collaborate on code, test, and deploy. The repository provides teams a single place for projects planning and collaboration on coding, testing, and deploying the software application. Which of the following is offered by Bitbucket to BVR Pvt. Ltd.?)
- A. Free unlimited public repositories.
- B. Free limited private repositories.
- C. Free unlimited private repositories.
- D. Free limited public repositories.
Answer: C
Explanation:
Bitbucket provides a cloud-based source code management platform that supports collaboration, CI/CD integration, and secure code hosting. One of the key features offered by Bitbucket isfree unlimited private repositories, particularly beneficial for organizations developing proprietary software such as IoT applications. This allows teams to store source code securely without exposing it publicly while still enabling collaboration features like pull requests, issue tracking, and pipeline automation. The term "limited private repositories" is inaccurate because Bitbucket does not restrict the number of private repositories under its free offering; rather, user count limits apply. While Bitbucket also supports public repositories, the option that best represents its value to enterprise and product-based teams is unlimited private repositories. This capability aligns with DevSecOps practices by ensuring confidentiality of source code while enabling integrated planning, testing, and deployment workflows within a single platform.
========
NEW QUESTION # 52
(Victor Garber is a DevSecOps team leader in SanSec Pvt. Ltd. His organization develops various types of software products and web applications. Currently, his team is working on security of Java-based web application product. How can Victor identify vulnerabilities that are missed in pre-production testing activities?.)
- A. By performing test-time checks.
- B. By performing deploy-time checks.
- C. By performing commit-time checks.
- D. By performing build-time checks.
Answer: B
Explanation:
Deploy-time checks are designed to identify vulnerabilities that may not surface during earlier stages such as commit-time, build-time, or test-time checks. These checks analyze applications in environments that closely resemble or are part of production, making it possible to detect configuration issues, runtime vulnerabilities, and environment-specific weaknesses. Pre-production testing often cannot fully replicate production conditions, so deploy-time checks act as an additional safety net. Commit-time and build-time checks focus on code quality and static analysis, while test-time checks validate application behavior in controlled environments. Deploy-time checks therefore help Victor uncover vulnerabilities missed earlier, improving overall security assurance before or during deployment.
========
NEW QUESTION # 53
(Cindy Williams has recently joined an IT company as a DevSecOps engineer. She configured Bundle-Audit in Travis CI. Cindy detected vulnerability in Gemfile dependencies and resolved it by adding some line of codes. How does Bundler scan Gemfile.lock for insecure versions of gems?)
- A. By taking the information from the travis.yml and comparing it with the unknown vulnerabilities.
- B. By taking the information from the Gemfile and comparing it with the known vulnerabilities.
- C. By taking the information from the Gemfile and comparing it with the unknown vulnerabilities.
- D. By taking the information from the travis.yml file and comparing it with the known vulnerabilities.
Answer: B
Explanation:
Bundler-Audit is a Software Composition Analysis (SCA) tool designed specifically for Ruby applications. It scans theGemfile and Gemfile.lockto identify all declared dependencies and their resolved versions. The Gemfile specifies which gems the application depends on, while the Gemfile.lock ensures consistent dependency versions across environments. Bundler-Audit compares this dependency information against a database ofknown vulnerabilitiesto identify insecure or outdated gems. It does not rely on the Travis CI configuration file for vulnerability detection, nor does it compare against unknown vulnerabilities. Integrating Bundler-Audit into the Build and Test stage ensures that vulnerable third-party libraries are detected early, allowing developers to remediate issues before the application progresses further in the pipeline. This practice supports shift-left security and reduces the risk of introducing known vulnerabilities into production systems.
========
NEW QUESTION # 54
(Debra Aniston is a DevSecOps engineer in an IT company that develops software products and web applications. Her team has found various coding issues in the application code. Debra would like to fix coding issues before they exist. She recommended a DevSecOps tool to the software developer team that highlights bugs and security vulnerabilities with clear remediation guidance, which helps in fixing security issues before the code is committed. Based on the information given, which of the following tools has Debra recommended to the software development team?)
- A. OWASP ZAP.
- B. Tenable.io.
- C. SonarLint.
- D. Arachni.
Answer: C
Explanation:
SonarLint is a static code analysis tool designed specifically to be used inside developers' IDEs, where it provides immediate feedback while code is being written. It highlights bugs, security vulnerabilities, and code smells and, importantly, providesclear remediation guidancethat explains why an issue exists and how it can be fixed. This aligns directly with Debra's requirement to fix issues "before they exist," meaning before code is committed to the repository. Arachni and OWASP ZAP are dynamic application security testing tools that require a running application and are typically used later in the pipeline. Tenable.io is a vulnerability management platform focused on infrastructure and application scanning rather than real-time developer feedback. By using SonarLint, developers receive continuous guidance during coding, supporting the shift-left security approach in DevSecOps and reducing the cost and effort of fixing vulnerabilities later in the lifecycle.
========
NEW QUESTION # 55
(Frances Fisher joined TerraWolt Pvt. Ltd. as a DevSecOps engineer in 2020. On February 1, 2022, his organization became a victim of cyber security attack. The attacker targeted the network and application vulnerabilities and compromised some important functionality of the application. To secure the organization against similar types of attacks, Franches used a flexible, accurate, low maintenance vulnerability management and assessment solution that continuously scans the network and application vulnerabilities and provides daily updates and specialized testing methodologies to catch maximum detectable vulnerabilities.
Based on the above-mentioned information, which of the following tools is Frances using?)
- A. Black Duck.
- B. SonarQube.
- C. Shadow Daemon.
- D. BeSECURE.
Answer: D
Explanation:
BeSECURE is a vulnerability management and assessment solution designed for continuous scanning of both network and application vulnerabilities. It emphasizes flexibility, accuracy, low maintenance overhead, and frequent updates to vulnerability detection mechanisms. These characteristics align directly with the scenario described, where the organization requires continuous scanning, daily updates, and specialized testing methodologies to detect a wide range of vulnerabilities. SonarQube focuses on static code quality and security analysis during development, Black Duck is primarily used for open-source software composition analysis, and Shadow Daemon is a web application firewall rather than a comprehensive vulnerability management solution. Using BeSECURE during the Operate and Monitor stage allows organizations to maintain ongoing visibility into their security posture, detect new vulnerabilities as they emerge, and reduce the likelihood of repeat attacks by addressing weaknesses proactively.
========
NEW QUESTION # 56
(Brady Coleman is a senior DevSecOps engineer at CloudVac Security Private Ltd. He has created a new container named "eccbrad" from the centos:7 image using the command docker run -i -t --name geeklab centos:7 /bin/bash. Now, Brady wants to install the httpd package inside the eccbrad container. Which of the following commands should Brady use to install the httpd package inside the container?)
- A. yum install-httpd.
- B. sudo install-httpd.
- C. yum install httpd.
- D. sudo install httpd.
Answer: C
Explanation:
The CentOS operating system uses theyumpackage manager to install software packages. Inside a CentOS- based Docker container, the correct way to install the Apache HTTP Server is by running yum install httpd.
Containers typically run as the root user by default, making the use of sudo unnecessary. Commands such as install-httpd are invalid because yum requires the install keyword followed by the package name separated by a space. Installing required packages inside containers should be done carefully to avoid bloating images and increasing the attack surface. During the Operate and Monitor stage, DevSecOps teams must balance functionality with container hardening best practices by installing only necessary components.
========
NEW QUESTION # 57
(Thomas Gibson has been working as a DevSecOps engineer in an IT company that develops software products and web applications related to law enforcement. To automatically execute a scan against the web apps, he would like to integrate InsightAppSec plugin with Jenkins. Therefore, Thomas generated a new API Key in the Insight platform. Now, he wants to install the plugin manually. How can Thomas install the InsightAppSec plugin manually in Jenkins?)
- A. By creating a .war file and uploading to his Jenkins installation.
- B. By creating a .zip file and uploading to his Jenkins installation.
- C. By creating a .conf file and uploading to his Jenkins installation.
- D. By creating a .hpi file and uploading to his Jenkins installation.
Answer: D
Explanation:
Jenkins plugins are distributed and installed as .hpi files. To manually install a plugin, administrators upload the .hpi file through the Jenkins Plugin Manager using the "Upload Plugin" option. This approach is commonly used in environments with restricted internet access or when custom plugin versions are required. .
war files are used for deploying the Jenkins application itself, not plugins, while .zip and .conf files are not recognized plugin formats. Installing the InsightAppSec plugin allows Jenkins pipelines to automatically trigger dynamic application security scans during the Build and Test stage. This integration ensures that web applications are continuously evaluated for vulnerabilities before deployment, supporting proactive security testing and risk reduction.
========
NEW QUESTION # 58
(Helena Luke has been working as a DevSecOps engineer in an IT company located in Denver, Colorado. To seamlessly secure source code during build time and enhance the runtime protection functionalities to the source code, she would like to integrate Jscrambler with GitLab. Therefore, she selected a predefined template and successfully downloaded the Jscrambler configuration file. She then placed the file in the project's root folder and renamed it as .jscramblerrc. To prevent the exposure of sensitive information, she opened the Jscrambler configuration file and removed the access and secret keys from it. In which of the following formats does the Jscrambler configuration file exist?.)
- A. HTML.
- B. YAML.
- C. JSON.
- D. XML.
Answer: C
Explanation:
The Jscrambler configuration file .jscramblerrc is written inJSON format. JSON is widely used for configuration because it is lightweight, human-readable, and easily parsed by tools in CI/CD pipelines.
Removing access and secret keys from this file is a recommended security practice to prevent credential leakage when the repository is shared or stored in version control. Instead, credentials are typically injected through environment variables or secure CI/CD secrets. XML, YAML, and HTML are not the formats used by Jscrambler for its primary configuration file. Using JSON-based configuration during the Code stage allows consistent integration with GitLab pipelines while maintaining secure handling of sensitive data.
========
NEW QUESTION # 59
(Jason Wylie has been working as a DevSecOps engineer in an IT company located in Sacramento, California. He would like to use Jenkins for CI and Azure Pipelines for CD to deploy a Spring Boot app to an Azure Container Service (AKS) Kubernetes cluster. He created a namespace for deploying the Jenkins in AKS, and then deployed the Jenkins app to the Pod. Which of the following commands should Jason run to see the pods that have been spun up and running?)
- A. kubectl get pods -n jenkins.
- B. kubectl get pods -p jenkins.
- C. kubectl get pods -s jenkins.
- D. kubectl get pods -k Jenkins.
Answer: A
Explanation:
Kubernetes uses namespaces to logically isolate resources such as pods, services, and deployments. When an application like Jenkins is deployed into a specific namespace, the correct way to view the pods running in that namespace is by using the -n (or --namespace) flag with the kubectl get pods command. The command kubectl get pods -n jenkins instructs Kubernetes to list all pods in the "jenkins" namespace. The other options use invalid or unrelated flags that are not supported for namespace selection. Verifying pod status during the Release and Deploy stage is essential to ensure that applications have been deployed successfully and are running as expected before exposing services or proceeding to monitoring. This step supports deployment validation and operational readiness in Kubernetes-based DevSecOps environments.
NEW QUESTION # 60
(Sarah Wright has recently joined a multinational company as a DevSecOps engineer. She has created a container and deployed a web application in it. Sarah would like to stop this container. Which of the following commands stop the running container created by Sarah Wright?)
- A. [root@574bac18f89d /]# stop.
- B. [root@574bac18f89d /]# clear.
- C. [root@574bac18f89d /]# kill.
- D. [root@574bac18f89d /]# exit.
Answer: D
Explanation:
When working inside an interactive Docker container session, the container continues running as long as its primary foreground process is active. Executing the exit command terminates the shell session, which in turn stops the container if no other foreground processes are running. The kill command requires a process identifier and is not used in this context, while clear simply clears the terminal screen and does not affect container execution. The stop command is not a valid shell command inside a container. Properly stopping containers during the Operate and Monitor stage helps free system resources, prevent unintended service exposure, and maintain a clean runtime environment. This practice aligns with container lifecycle management best practices and reduces operational risk.
========
NEW QUESTION # 61
(Dustin Hoffman has been working as a DevSecOps engineer in an IT company located in San Diego, California. For detecting new security vulnerabilities at the beginning of the source code development, he would like to integrate Checkmarx SCA tool with GitLab. The Checkmarx template has all the jobs defined for pipeline. Where should Dustin incorporate the Checkmarx template file 'https://raw.githubusercontent.com
/checkmarx-ltd/cx-flow/develop/templates/gitlab/v3/Checkmarx.gitlab-ci.yml'?)
- A. gitlab-ci/cd.yml root directory.
- B. gitlab.yml root directory.
- C. gitlab-ci.yml root directory.
- D. gitlab-cd.yml root directory.
Answer: C
Explanation:
GitLab CI/CD pipelines are defined using a configuration file namedgitlab-ci.yml, which must be placed in the root directory of the repository. This file controls pipeline stages, jobs, and template inclusions. To integrate Checkmarx SCA using a predefined template, the template reference must be included in the root- level gitlab-ci.yml file so GitLab can load and execute the defined jobs automatically. The other filenames listed in the options are not recognized by GitLab as valid pipeline configuration files. Integrating SCA at the Code stage allows early detection of vulnerable open-source dependencies, reducing remediation cost and preventing insecure components from progressing further in the DevSecOps pipeline.
NEW QUESTION # 62
(GainInsights is an IT company that develops mobile applications software. On February 11, 2022, the organization became a victim of a cyber-attack. The attacker targeted the organization's application and compromised some important functionality. After the incident, the DevSecOps team of GainInsights identified the cause of the security issue, resolved it, and noted it for future reference. Based on this information, which of the following set of tests was conducted by GainInsights?.)
- A. Security acceptance tests.
- B. White box testing.
- C. Security smoke tests.
- D. Blameless post-mortem.
Answer: D
Explanation:
Ablameless post-mortemis conducted after a security incident to analyze what happened, why it happened, and how similar incidents can be prevented in the future-without assigning individual blame. The key indicators in the scenario are that the team identified the cause, resolved the issue, and documented lessons learned for future reference. Security acceptance tests and smoke tests are pre-release validation activities, while white-box testing focuses on code-level analysis rather than incident review. Blameless post-mortems are a cornerstone of DevSecOps culture, encouraging transparency, continuous learning, and systemic improvement during the Operate and Monitor stage.
========
NEW QUESTION # 63
(Patrick Fisher is a DevSecOps engineer in an IT company that develops software products and web applications. He is using IAST to analyze code for security vulnerabilities and to view real-time reports of the security issues. Patrick is using IAST in development, QA, and production stages to detect the vulnerabilities from the early stage of development, reduce the remediation cost, and keep the application secure. How can IAST perform SAST on every line of code and DAST on every request and response?.)
- A. Because IAST has access to offline and runtime environment.
- B. Because IAST has access to internal and external agents.
- C. Because IAST has access to server and local machine.
- D. Because IAST has access to the code and HTTP traffic.
Answer: D
Explanation:
Interactive Application Security Testing (IAST) works by instrumenting the application at runtime, allowing it to observe both thesource code execution pathsand theHTTP requests and responsesflowing through the application. Because of this dual visibility, IAST can analyze every executed line of code (similar to SAST) while also monitoring real-time application behavior (similar to DAST). This unique capability enables highly accurate vulnerability detection with fewer false positives. The other options do not correctly explain how IAST achieves this hybrid analysis. Access to both code and HTTP traffic is what allows IAST to bridge static and dynamic testing techniques, making it highly effective across development, QA, and production environments.
========
NEW QUESTION # 64
......
312-97 Sample with Accurate & Updated Questions: https://pdfpractice.actual4dumps.com/312-97-study-material.html