Oct 24, 2026 312-97 Exam Crack Test Engine Dumps Training With 102 Questions
Obtain the 312-97 PDF Dumps Get 100% Outcomes Exam Questions For You To Pass
ECCouncil 312-97 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
| Topic 6 |
|
NEW QUESTION # 10
(Paul McCartney has been working as a senior DevSecOps engineer in an IT company over the past 5 years.
He would like to integrate Conjur secret management tool into the CI/CD pipeline to secure the secret credentials in various phases of development. To integrate Conjur with Jenkins, Paul downloaded Conjur.hpi file and uploaded it to the Upload Plugin section of Jenkins. Paul declared a policy branch using a code and saved it as a .yml file. Which of the following commands should Paul use to load this policy in Conjur root?)
- A. $ conjur policy load -f root -b < file-name >.
- B. $ conjur policy load -p root -f < file-name >.
- C. $ conjur policy load -b root -f < file-name >.
- D. $ conjur policy load -f root -p < file-name >.
Answer: C
Explanation:
Conjur policies define access controls, authentication rules, and secret variables, and they must be loaded into the correct policy branch. The conjur policy load command uses the -b flag to specify thepolicy branchand the -f flag to specify thepolicy file. To load a policy into the root branch, the correct command is conjur policy load -b root -f <file-name>. Options that reverse or misuse these flags are invalid and would either fail or load the policy incorrectly. Loading policies correctly during the Build and Test stage ensures that Jenkins pipelines can securely access secrets at runtime, enforcing centralized secret management, least-privilege access, and compliance with security requirements.
========
NEW QUESTION # 11
(Jayson Smith is working as a DevSecOps engineer in an MNC company located in Tampa, Florida. The senior software developer of his company, Sandra Oliver, has uploaded an application in her GitHub repository that might contain security vulnerabilities and has provided the URL to the DevSecOps team.
Jayson would like to analyze the application developed by Sandra to detect and mitigate the security issues in the application code; therefore, he would like to clone Sandra's GitHub repository to his computer. Which of the following commands should Jayson use to clone the repository of another user to his computer?)
- A. $ git clonehttps://github.com/USERNAME/REPOSITORY.git.
- B. $ github clonehttps://github.com/USERNAME/REPOSITORY.git.
- C. $ github clonehttps://github.com/REPOSITORY/USERNAME.git.
- D. $ git clonehttps://github.com/REPOSITORY/USERNAME.git.
Answer: A
Explanation:
Cloning a GitHub repository requires the standard Git command git clone followed by the correct repository URL format. GitHub repositories are structured as https://github.com/USERNAME/REPOSITORY.git, where USERNAME represents the account or organization name and REPOSITORY represents the project name.
Option B follows this exact structure. Options using github clone are invalid because github is not a Git CLI command. Options that reverse the order of USERNAME and REPOSITORY do not match GitHub's repository structure and will fail. Cloning repositories during the Code stage allows DevSecOps engineers to run static analysis, dependency scanning, and other security checks locally without modifying the original repository, supporting secure and controlled analysis workflows.
========
NEW QUESTION # 12
(Nicholas Cascone has recently been recruited by an IT company from his college as a DevSecOps engineer.
His team leader asked him to integrate GitHub Webhooks with Jenkins. To integrate GitHub Webhooks with Jenkins, Nicholas logged in to GitHub account; he then selected Settings > Webhooks > Add Webhook. In the Payload URL field, he is supposed to add Jenkins URL. Which of the following is the final Jenkins URL format that Nicholas should add in Payload URL field of GitHub to configure GitHub Webhooks with Jenkins?.)
- A. http://address:port/GiHhub-webhook/.
- B. http://address:port/GitHub.webhook/.
- C. http://address:port/github-webhook/.
- D. http://address:port/github_webhook/.
Answer: C
Explanation:
Jenkins exposes a predefined endpoint for receiving GitHub webhook events. This endpoint is /github- webhook/ and must be appended to the Jenkins base URL in the GitHub webhook configuration. Option C correctly matches the required endpoint format. The other options use incorrect casing, separators, or naming conventions that Jenkins does not recognize. Correct webhook configuration ensures that Jenkins jobs are automatically triggered when code changes occur in GitHub repositories. This integration supports continuous integration and immediate feedback during the Code stage of the DevSecOps pipeline.
========
NEW QUESTION # 13
(Andrew Gerrard has recently joined an IT company located in Fairmont, California, as a DevSecOps engineer. Due to robust security and cost-effective service provided by AWS, his organization has migrated all the workloads from on-prem to AWS cloud in January of 2020. Andrew's team leader has asked him to integrate AWS Secret Manager with Jenkins. To do so, Andrew installed the "AWS Secret Manager Credentials provider" plugin in Jenkins and configured an IAM policy in AWS that allows Jenkins to take secrets from AWS Secret manager. Which of the following file should Andrew edit to add access id and secret key parameters along with the region copied from AWS?.)
- A. /etc/file/Jenkins.
- B. /etc/filebeat/filebeat.yml.
- C. /etc/sysconfig/Jenkins.
- D. /etc/sysconfig file/Jenkins.
Answer: C
Explanation:
On Linux systems, Jenkins environment variables such as AWS access key ID, secret access key, and default region are commonly configured in the /etc/sysconfig/Jenkins file. This file allows administrators to define environment variables that are loaded when the Jenkins service starts. By placing AWS credentials and region information in this file, Jenkins jobs and plugins-such as the AWS Secrets Manager Credentials Provider- can securely access AWS resources. The other options reference invalid paths or unrelated configuration files (such as Filebeat). Editing /etc/sysconfig/Jenkins ensures consistent credential availability across Jenkins jobs while supporting secure integration with AWS services during the Code stage.
NEW QUESTION # 14
(Sarah Wheeler is an experienced DevSecOps engineer. She recently joined an IT company that develops software products for customers stretched across the globe. Sarah would like to use a security testing tool that protects the application from false positives, network sniffing, tampering with code, etc. The tool should monitor the incoming traffic to the server and APIs for suspicious activities and help her team in remediating them during runtime. Which of the following tools should Sarah select that will help her team in precisely detecting and remediating the security issues in the application code during runtime?.)
- A. SAST.
- B. DAST.
- C. RASP.
- D. IAST.
Answer: C
Explanation:
Runtime Application Self-Protection (RASP) operates from within the application runtime environment, monitoring incoming traffic, API calls, and execution behavior in real time. Because it has deep visibility into application logic and execution context, RASP can accurately detect attacks such as injection, tampering, and abnormal behavior while minimizing false positives. SAST analyzes source code statically, DAST tests running applications externally, and IAST combines some runtime insight with testing but does not actively block threats. RASP's ability to detect and remediate attacks during runtime makes it ideal for protecting applications in production environments, aligning with the Operate and Monitor stage of the DevSecOps pipeline.
NEW QUESTION # 15
(Erica Mena has been working as a DevSecOps engineer in an IT company that provides customize software solutions to various clients across United States. To protect serverless and container applications with RASP, she would like to create an Azure container instance using Azure CLI in Microsoft PowerShell. She created the Azure container instance and loaded the container image to it. She then reviewed the deployment of the container instance. Which of the following commands should Erica run to get the logging information from the Azure container instance? (Assume the resource group name as ACI and container name as aci-test- closh.))
- A. az container logs --resource-group ACI --name aci-test-closh.
- B. az get container logs --resource-group ACI --name aci-test-closh.
- C. az container logs -resource-group ACI -name aci-test-closh.
- D. az get container logs -resource-group ACI --name aci-test-closh.
Answer: A
Explanation:
Azure Container Instances provide built-in logging capabilities that can be accessed using the Azure CLI. To retrieve logs from a deployed container instance, the correct command isaz container logsfollowed by the resource group and container name. The proper syntax requires double-dash parameters:--resource-groupand
--name. In Erica's case, the correct command is az container logs --resource-group ACI --name aci-test-closh.
Options that use "az get container logs" are invalid because "get" is not a supported verb in this context.
Option C uses incorrect single-dash flags, which do not match Azure CLI standards. Accessing container logs during the Code stage helps engineers validate application behavior, identify runtime errors, and ensure that security instrumentation such as RASP agents are functioning correctly before progressing further in the pipeline.
========
NEW QUESTION # 16
(Bruce Altman is a DevSecOps engineer at a web application development company named TechSoft Pvt.
Ltd. Due to robust security features provided by Microsoft Azure, in January of 2020, his organization migrated all the workloads from on-prem to Azure. Using Terraform configuration management tool, Bruce created a resource group and virtual machine (VM) in Azure; he then deployed a web application in the VM.
Within an hour, Bruce's team leader informed him that he detected various security issues in the application code and asked him to destroy the infrastructure that he has created in Microsoft Azure using Terraform.
Which of the following commands can Bruce use to destroy the infrastructure created using Terraform?.)
- A. terraform kill.
- B. terraform destroy.
- C. terraform kill-infra.
- D. terraform destroy-infra.
Answer: B
Explanation:
Terraform provides the terraform destroy command to remove all infrastructure resources defined in the Terraform configuration files. This command safely tears down resources such as virtual machines, networks, and resource groups by consulting the state file and executing destruction in the correct dependency order.
Commands like terraform kill, terraform kill-infra, and terraform destroy-infra do not exist in Terraform's CLI. Using terraform destroy during the Release and Deploy stage allows DevSecOps teams to quickly remediate risk by removing insecure or non-compliant infrastructure, reinforcing the importance of Infrastructure as Code and controlled lifecycle management.
========
NEW QUESTION # 17
(Scott Morrison is working as a senior DevSecOps engineer at SUTRE SOFT Pvt. Ltd. His organization develops software and applications for IoT devices. Scott created a user story; he then created abuser stories under the user story. After that, he created threat scenarios under the abuser story, and then he created test cases for the threat scenarios. After defining the YAML, Scott would like to push the user-story driven threat model to the ThreatPlaybook server. Which of the following command Scott should use?.)
- A. playbook apply feature -y < path to the yaml file > -p test-project.
- B. playbook apply feature -f < path to the yaml file > -t test-project.
- C. playbook apply feature -p < path to the yaml file > -t test-project.
- D. playbook apply feature -f < path to the yaml file > -p test-project.
Answer: D
Explanation:
ThreatPlaybook uses the playbook apply feature command to push user-story-driven threat models to the server. The -f flag specifies the path to the YAML file containing the defined user stories, abuser stories, and threat scenarios, while the -p flag specifies the target project. Option C correctly combines these parameters.
The -y flag is invalid in this context, and options that misuse -t instead of -p do not correctly identify the project destination. Executing this command during the Plan stage enables teams to integrate threat modeling early, ensuring security risks are identified and addressed before development and deployment proceed.
NEW QUESTION # 18
(Kevin Ryan has been working as a DevSecOps engineer in an MNC company that develops various software products and web applications. For easy management of secret credentials in CI/CD pipeline, he would like to integrate Azure Key Vault with Jenkins. Therefore, he created an Azure Key Vault, noted down the credentials displayed on the screen, and created a secret in Azure Key Vault. Then, he used the secret key from the credentials obtained from creating the vault. Kevin went back to Jenkins and installed Azure Key Vault plugin. Then, he navigated to Configure System under Manage Jenkins and added the URL for Azure Key Vault. How can Kevin complete the integration of Azure Key Vault with Jenkins?.)
- A. By modifying old credentials in Global Credentials (unrestricted).
- B. By modifying old credentials in Global Credentials (restricted).
- C. By creating new credentials in Global Credentials (unrestricted).
- D. By creating new credentials in Global Credentials (restricted).
Answer: C
Explanation:
To complete Azure Key Vault integration with Jenkins, Kevin must createnew credentialsin Jenkins under Global Credentials (unrestricted). These credentials store the Azure client ID, client secret, tenant ID, and subscription details required by the Azure Key Vault plugin to authenticate securely. Modifying old credentials can lead to misconfiguration or credential reuse risks, while restricted credentials may prevent the plugin from accessing secrets across pipelines. Creating new unrestricted credentials ensures proper authentication and controlled access to secrets during the Code stage, supporting secure secret management across CI/CD workflows.
NEW QUESTION # 19
(Rockmond Dunbar is a senior DevSecOps engineer in a software development company. His organization develops customized software for retail industries. Rockmond would like to avoid setting mount propagation mode to share until it is required because when a volume is mounted in shared mode, it does not limit other containers to mount and modify that volume. If mounted volume is sensitive to changes, then it would be a serious security concern. Which of the following commands should Rockmond run to list out the propagation mode for mounted volumes?.)
- A. docker ps -quiet -all | xargs docker inspect -format ': Propagation'.
- B. docker ps --quiet --all | xargs docker inspect --format ': Propagation='.
- C. docker ps -quiet -all | xargs docker inspect -format ': Propagation='.
- D. docker ps --quiet --all | xargs docker inspect --format ': Propagation'.
Answer: B
Explanation:
To inspect mount propagation modes for Docker containers, Rockmond needs to list all container IDs and then inspect their configuration. The docker ps --quiet --all command outputs container IDs only, which are then passed to docker inspect using xargs. The --format option allows extraction of specific fields, such as mount propagation settings. Option C correctly uses valid flags (--quiet --all) and proper formatting syntax.
Options A and D incorrectly use single hyphens, and option B omits the equals sign, which is required to display the propagation value. Inspecting mount propagation during the Operate and Monitor stage helps prevent unintended privilege escalation or data modification by other containers, aligning with container hardening best practices.
========
NEW QUESTION # 20
(Alexander Hamilton has been working as a senior DevSecOps engineer in an IT company located in Greenville, South Carolina. In January of 2012, his organization because a victim of a cyber security attack and incurred a tremendous loss. Alexander's organization immediately adopted AWS cloud-based services after the attack to develop robust software products securely and quickly. To detect security issues in code review, Alexander would like to integrate SonarQube with AWS Pipeline; therefore, he created a pipeline in AWS using CloudFormation pipeline template. Then, he selected SonarQube tool from the tools dropdown, provided the required stack parameters, and also provided email address for receiving email notifications of changes in pipeline status and approvals. He deployed the pipeline after entering the required information.
What will happen when changes are committed in the application repository?.)
- A. Security Hub event is created.
- B. BinSkim event is created.
- C. Cloud Config event is created.
- D. CloudWatch event is created.
Answer: D
Explanation:
When changes are committed to a repository connected to an AWS Pipeline, the pipeline execution is triggered and monitored usingAmazon CloudWatch events. CloudWatch captures pipeline state changes, execution status, and approval notifications, enabling real-time monitoring and alerting. AWS Config tracks resource configuration changes, BinSkim is a binary analysis tool, and Security Hub aggregates security findings but does not directly track pipeline execution events. Integrating SonarQube into AWS Pipeline ensures static code analysis runs automatically upon commits, while CloudWatch provides visibility into pipeline activity. This setup strengthens security automation during the Code stage by ensuring every commit is analyzed and monitored.
========
NEW QUESTION # 21
(Katie Holmes is working as a DevSecOps engineer at SeCSafe Anti-virus. The DevOps team of her organization has developed a distributed application with multiple microservices. Katie deployed all the microservices to the Kubernetes nodes successfully. The DevOps team approached Katie and informed her that the application is not working. Katie wants to check whether the Kubernetes cluster is working or not.
Which of the following commands should Katie run step by step to verify that the Kubernetes is working?)
- A. kubernetes version kubebernetes cluster-info.
- B. kube-etcd version kube-etcd cluster-info.
- C. kubectl version kubectl cluster-info.
- D. kube version kube cluster-info.
Answer: C
Explanation:
Kubernetes clusters are managed and inspected using the kubectl command-line tool. To verify whether a Kubernetes cluster is functioning correctly, administrators commonly run kubectl version to confirm that both the client and server components are reachable and operational. This is followed by kubectl cluster-info, which displays information about the cluster's control plane and core services. These commands together confirm API server availability, cluster connectivity, and basic health status. The other options list invalid command names such as kube, kubernetes, or kube-etcd, which are not used for standard cluster validation.
Performing these checks during the Operate and Monitor stage helps quickly identify whether application issues stem from cluster-level problems or application-level misconfigurations. This supports faster troubleshooting and more reliable production operations.
========
NEW QUESTION # 22
(Joyce Vincent has been working as a senior DevSecOps engineer at MazeSoft Solution Pvt. Ltd. She would like to integrate Trend Micro Cloud One RASP tool with Microsoft Azure to secure container-based application by inspecting the traffic, detecting vulnerabilities, and preventing threats. In Microsoft Azure PowerShell, Joyce created the Azure container instance in a resource group (ACI) (named "aci-test-closh") and loaded the container image to it. She then reviewed the deployment of the container instance. Which of the following commands should Joyce use to get the logging information from the container?.)
- A. azure container logs -resource-group ACI -name aci-test-closh.
- B. az container logs --resource-group ACI --name aci-test-closh.
- C. azure container logs --resource-group ACI --name aci-test-closh.
- D. az container logs -resource-group ACI -name aci-test-closh.
Answer: B
Explanation:
Azure Container Instances (ACI) exposes container logs via the Azure CLI using the az container logs command. To retrieve logs, you must provide the resource group and the container group name using the long- form parameters --resource-group and --name. Option A matches the correct CLI structure and parameter format: az container logs --resource-group ACI --name aci-test-closh. Options B and D incorrectly use single- dash forms (-resource-group and -name), which are not valid for these long option names. Options C and D incorrectly use azure instead of az; the Azure CLI command group is invoked with az, not azure. Getting logs after deployment review is a critical Operate and Monitor activity: it helps confirm the container started correctly, diagnose runtime errors, and validate that runtime protection (such as a RASP/micro-agent) is functioning. This visibility supports faster incident response and helps ensure the containerized workload remains secure and stable in its runtime environment.
========
NEW QUESTION # 23
(Robert Wheeler has been working as a DevSecOps engineer in an IT company for the past 5 years. His organization develops software products and web applications related to AutoCAD. Rob would like to integrate Rapid7 tCell Next-Gen Cloud WAF and RASP Tool with AWS CloudFront to protect application by identifying suspicious actors, enforcing content security policies (CSPs), and securing against unvalidated HTTP redirections on web applications. How can Rob deploy the tCell agent as a CloudFormation stack into his organization AWS account?.)
- A. By plugging into CloudFormation through Lambda Function.
- B. By plugging into CloudFormation through Lambda@Edge.
- C. By plugging into CloudFront through Lambda Function.
- D. By plugging into CloudFront through Lambda@Edge.
Answer: D
Explanation:
When integrating security controls at the CDN edge with AWS CloudFront, the typical deployment model usesLambda@Edge, which allows code to execute at CloudFront edge locations on viewer request/response or origin request/response events. Deploying the tCell agent "as a CloudFormation stack" describes packaging the required AWS resources (IAM roles, functions, permissions, and CloudFront associations) into infrastructure-as-code, but the actual attachment point for CloudFront request/response processing is Lambda@Edge. Option C correctly reflects this: "plugging into CloudFront through Lambda@Edge." Standard Lambda functions run in regional AWS environments and cannot directly run at CloudFront edge locations in the same way; therefore, "CloudFront through Lambda Function" is not the best match for edge enforcement needs like CSP handling and redirect protections. Options that claim "plugging into CloudFormation" misunderstand CloudFormation's role: it deploys resources, but it is not the runtime integration point. Hence, CloudFront + Lambda@Edge is the correct deployment approach.
NEW QUESTION # 24
(Matt LeBlanc has been working as a DevSecOps engineer in an IT company that develops software products and web applications for IoT devices. His team leader has asked him to use GitRob tool to find sensitive data in the organizational public GitHub repository. To install GitRob, Matt ensured that he has correctly configured Go >= 1.8 environment and that $GOPATH/bin is in his $PATH. The GitHub repository URL from which he is supposed to install the tool ishttps://github.com/michenriksen/gitrob. Which of the following command should Matt use to install GitRob?.)
- A. $ go get github.com/michenriksen/gitrob.
- B. $ go get gitrob github.com/michenriksen/gitrob.
- C. $ go git github.com/michenriksen/gitrob.
- D. $ go git gitrob github.com/michenriksen/gitrob.
Answer: A
Explanation:
In Go-based tool installation, the standard method to download, compile, and install a Go package is using the go get command followed by the repository import path. Since Matt has already ensured that Go version 1.8 or later is installed and that $GOPATH/bin is included in the system PATH, running go get github.com
/michenriksen/gitrob will fetch the GitRob source code, build the binary, and place it in the appropriate bin directory. Options B, C, and D are invalid because go get does not accept multiple positional arguments in that manner, and go git is not a valid Go command. Installing GitRob during the Code stage enables DevSecOps teams to scan repositories for accidentally committed credentials, API keys, and other sensitive information, helping prevent data leakage from public repositories.
========
NEW QUESTION # 25
(Evan Peters has been working as a DevSecOps engineer in an IT company located in Denver, Colorado. His organization has deployed various applications on Docker containers. Evan has been running SSH service inside the containers, and handling of SSH keys and access policies is a major security concern for him. What will be the solution for Evan security concern?)
- A. Run SSH on the registry and utilize docker exec for interacting with the container.
- B. Run SSH on the docker build and utilize docker exec for interacting with the container.
- C. Run SSH on the host and utilize docker exec for interacting with the container.
- D. Run SSH on the client and utilize docker exec for interacting with the container.
Answer: C
Explanation:
Running an SSH service inside Docker containers is considered a security anti-pattern because it increases the attack surface and complicates key and access management. Containers are designed to run a single primary process and be managed externally rather than accessed via SSH. The recommended solution is torun SSH on the host systemand use docker exec to interact with containers when administrative access is required.
This approach eliminates the need to manage SSH keys inside containers, reduces exposure to brute-force attacks, and simplifies access control. The other options incorrectly suggest running SSH in inappropriate locations such as the registry, client, or build process, which do not address the core security concern. During the Operate and Monitor stage, minimizing unnecessary services within containers is critical to enforcing least privilege and maintaining a secure runtime environment.
========
NEW QUESTION # 26
(William O'Neil has been working as a senior DevSecOps engineer in an IT company that develops software products related to ecommerce. At this point in time, his team is working on securing a python-based application. Using GitGraber, William would like to detect sensitive information in real-time in his organizational GitHub repository. Therefore, he downloaded GitGraber and installed the dependencies. Which of the following commands should William use to find secrets using a keyword (assume the keyword is yahoo)?.)
- A. python3 gitGraber.py -k wordlist/keywordsfile.txt -q "\yahoo" -s.
- B. python3 gitGraber.py -p wordlist/keywordsfile.txt -q "\yahoo" -s.
- C. python3 gitGraber.py -g wordlist/keywordsfile.txt -q "\yahoo" -s.
- D. python3 gitGraber.py -w wordlist/keywordsfile.txt -q "\yahoo" -s.
Answer: A
Explanation:
GitGraber uses specific command-line flags to define how secret detection is performed. The -k flag is used to specify akeyword filethat contains search terms for identifying sensitive data in repositories. In this case, William wants to search for secrets using the keyword "yahoo," which is passed using the -q flag. Options -w,
-g, and -p are not valid flags for keyword-based scanning in GitGraber. By using -k, GitGraber scans repositories for matches against the defined keywords and reports potential secret exposures in real time. This capability is especially valuable during the Code stage, helping teams prevent credential leakage and maintain secure repositories.
NEW QUESTION # 27
(William Edwards is working as a DevSecOps engineer at SVR Software Solution Pvt. Ltd. His organization develops software products and applications related to digital marketing. William integrated Prisma Cloud with Jenkins to detect threat-intelligence based threat detection. This integration will allow him to scan container images and serverless functions for security issues in the CI/CD pipeline. Which of the following is employed by Prisma Cloud to understand the normal network behavior of each customer's cloud environment to detect network anomalies and zero-day attacks effectively with minimal false positives?.)
- A. Advanced supervised machine learning.
- B. Advanced supervised data mining.
- C. Advanced unsupervised machine learning.
- D. Advanced unsupervised data mining.
Answer: C
Explanation:
Prisma Cloud leveragesadvanced unsupervised machine learningto establish baselines of normal behavior within a customer's cloud environment. By analyzing patterns in network traffic, resource interactions, and workload behavior without relying on labeled training data, it can detect anomalies and potential zero-day attacks with minimal false positives. Supervised approaches require predefined labels and known attack patterns, which limits effectiveness against new or unknown threats. Unsupervised data mining alone lacks the adaptive intelligence provided by machine learning models. Using unsupervised machine learning during the Build and Test stage enables continuous, intelligent security analysis across dynamic cloud-native workloads, supporting proactive threat detection in DevSecOps pipelines.
NEW QUESTION # 28
(William Friedkin has been working as a DevSecOps engineer in an IT company for the past 3 years. His team leader has asked him to validate the host configuration that runs the Docker containers and perform security checks at the container level by implementing Docker's CIS Benchmark Recommendations.
Therefore, William would like to integrate Docker Bench with Jenkins to incorporate security testing in DevOps workflow and secure the Docker Container. Before starting the procedure, he would like to install openssh on Ubuntu. Which of the following command should William run to install openssh on Ubuntu?)
- A. sudo apt.get -s install openssh-server.
- B. sudo apt.get install openssh-server.
- C. sudo apt-get install openssh-server.
- D. sudo apt-get -s install openssh-server.
Answer: C
Explanation:
Ubuntu systems use the Advanced Package Tool (APT) for installing and managing software packages. The correct syntax for installing a package is sudo apt-get install <package-name>. In this case, the OpenSSH server package required for secure remote access is named openssh-server, makingsudo apt-get install openssh-serverthe correct command. Options using apt.get are invalid because the command syntax is incorrect. Options that include the -s flag only simulate the installation process and do not actually install the package. Installing OpenSSH is often required when integrating Docker Bench with Jenkins, as it enables secure communication and remote execution of compliance checks. Performing this setup during the Build and Test stage ensures that container hosts comply with Docker CIS Benchmark recommendations, helping organizations identify misconfigurations and security weaknesses early in the pipeline.
========
NEW QUESTION # 29
(Walter O'Brien recently joined as a junior DevSecOps engineer in an IT company located in Lansing, Michigan. His organization develops robotic process automation software for various clients stretched across the globe. Walter's team leader asked him to configure username and user email for git in VS Code.
Therefore, he opened Visual Studio Code IDE console, then clicked on Terminal tab and selected New terminal. Which of the following command should Walter execute in the terminal to configure username and user email for git in VS Code?)
- A. get config --global user_name "walter username for git"
get config --global user_email "walter email address used for git". - B. get config --global user-name "walter username for git"
get config --global user-email "walter email address used for git". - C. get git config --global user.name "walter username for git"
get git config -global user.email "walter email address used for git". - D. get config --global user.name "walter username for git"
get config -global user.email "walter email address used for git".
Answer: D
Explanation:
Git requires developers to configure their identity using two specific configuration keys:user.nameanduser.
email. These values are embedded into every commit and are essential for accountability, auditing, and collaboration. The correct configuration syntax uses dot-separated key names (user.name and user.email) and the --global flag to apply the settings across all repositories on the system. Among the provided options, only optionBuses the correct configuration keys. The other options use invalid key names such as user-name, user_name, or incorrect command structure. Although the options display a minor command typo ("get config" instead of git config), the question is clearly testing knowledge of the correct Git configuration keys.
Configuring Git identity in the Code stage ensures accurate commit history and supports traceability across the DevSecOps pipeline.
NEW QUESTION # 30
(Gabriel Bateman has been working as a DevSecOps engineer in an IT company that develops virtual classroom software for online teaching. He would like to clone the BDD security framework on his local machine using the following URL,https://github.com/continuumsecurity/bdd-security.git. Which of the following command should Gabriel use to clone the BBD security framework?)
- A. github clonehttps://github.com/continumsecurity/bdd-security.git.
- B. git clonehttps://github.com/continumsecurity/bdd-security.git.
- C. git clonehttps://github.com/continuumsecurity/bdd-security.git.
- D. github clonehttps://github.com/continuumsecurity/bdd-security.git.
Answer: C
Explanation:
To clone a repository from GitHub, the correct command is git clone followed by the accurate repository URL. The organization name continuumsecurity and repository name bdd-security must be spelled correctly for the command to succeed. Options using github clone are invalid because github is not a standard Git command-line utility. Options with misspelled organization names will result in errors. Cloning security testing frameworks during the Code stage enables DevSecOps engineers to evaluate, customize, and integrate security automation tools into development workflows, supporting secure application development and testing practices.
NEW QUESTION # 31
(Steven Gerrard has been working as a DevSecOps engineer at an IT company that develops software products and applications related to the healthcare industry. His organization has been using Azure DevOps services to securely and quickly develop software products. To ensure that the deployed infrastructure is in accordance with the architecture and industrial standards and the security policies are appropriately implemented, she would like to integrate InSpec with Azure. Therefore, after installation and configuration of InSpec, she created InSpec profile file and upgraded it with personal metadata and Azure resource pack information; then she wrote the InSpec tests. Which of the following commands should Steven use to run InSpec tests to check the compliance of Azure infrastructure?)
- A. inspec exec inspec-tests/integration/ -it azure://.
- B. inspec exec inspec-tests/integration/ -t azure://.
- C. inspec exe inspec-tests/integration/ -t azure://.
- D. inspec exe inspec-tests/integration/ -it azure://.
Answer: B
Explanation:
Chef InSpec executes compliance tests using the inspec exec command. When testing Azure infrastructure, InSpec requires a target specification using the -t flag with the Azure transport identifier azure://. The correct command is inspec exec inspec-tests/integration/ -t azure://. Options using exe instead of exec are invalid due to incorrect command spelling. Options that use the -it flag misuse command-line parameters that are not intended for target selection. Running InSpec tests in this way allows DevSecOps teams to validate that Azure resources comply with architectural, security, and regulatory requirements. Integrating these checks into the Build and Test stage ensures continuous compliance and reduces the risk of insecure infrastructure reaching production environments.
========
NEW QUESTION # 32
(BVR Pvt. Ltd. is an IT company that develops software products and applications related to IoT devices. The software development team of the organization is using Bitbucket repository to plan projects, collaborate on code, test, and deploy. The repository provides teams a single place for projects planning and collaboration on coding, testing, and deploying the software application. Which of the following is offered by Bitbucket to BVR Pvt. Ltd.?)
- A. Free unlimited public repositories.
- B. Free unlimited private repositories.
- C. Free limited private repositories.
- D. Free limited public repositories.
Answer: B
Explanation:
Bitbucket provides a cloud-based source code management platform that supports collaboration, CI/CD integration, and secure code hosting. One of the key features offered by Bitbucket isfree unlimited private repositories, particularly beneficial for organizations developing proprietary software such as IoT applications. This allows teams to store source code securely without exposing it publicly while still enabling collaboration features like pull requests, issue tracking, and pipeline automation. The term "limited private repositories" is inaccurate because Bitbucket does not restrict the number of private repositories under its free offering; rather, user count limits apply. While Bitbucket also supports public repositories, the option that best represents its value to enterprise and product-based teams is unlimited private repositories. This capability aligns with DevSecOps practices by ensuring confidentiality of source code while enabling integrated planning, testing, and deployment workflows within a single platform.
========
NEW QUESTION # 33
(Jason Barry has been working as a DevSecOps engineer in an IT company that develops software products and applications for ecommerce companies. During the build-time check, Jason discovered SQL injection and XXS security issues in the application code. What action does the build-time check perform on the application code?.)
- A. It will send an alert to SIEM and continue with test-time check.
- B. It will ignore the security issue and continue the build process.
- C. It will stop the build process.
- D. It will send a message to issue and project management tool and continue with deploy-time check.
Answer: C
Explanation:
Build-time checks are designed to enforce security gates within the CI/CD pipeline. When critical vulnerabilities such as SQL injection and cross-site scripting (XSS) are detected during this stage, the correct and expected behavior is tofail the build. Stopping the build process prevents insecure code from progressing to later stages such as testing, deployment, or production. Ignoring issues or merely sending alerts while continuing the pipeline undermines the purpose of shift-left security. Alerts to SIEM systems and issue trackers are typically supplementary actions, but the primary enforcement mechanism at build time is to block the pipeline when severity thresholds are exceeded. This approach reduces remediation costs, limits exposure, and ensures that only secure artifacts move forward in the DevSecOps lifecycle.
========
NEW QUESTION # 34
......
312-97 Exam Dumps Contains FREE Real Quesions from the Actual Exam: https://www.pass4sures.top/Certified-DevSecOps-Engineer/312-97-testking-braindumps.html