10 free EC-Council 312-97 ECDE practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 100 questions. Work through them, then open each answer to check your reasoning.
Get all 100 questions (US$39) · Download these 10 as a PDF
Question 1
Andrew Gerrard has recently joined an IT company located in Fairmont, California, as a DevSecOps engineer. Due to robust security and costeffective service provided by AWS, his organization has migrated all the workloads from on-prem to AWS cloud in January of 2020. Andrew’s team leader has asked him to integrate AWS Secret Manager with Jenkins. To do so, Andrew installed the “AWS Secret Manager Credentials provider” plugin in Jenkins and configured an IAM policy in AWS that allows Jenkins to take secrets from AWS Secret manager.
Which of the following file should Andrew edit to add access id and secret key parameters along with the region copied from AWS?
Show answer and explanation
Correct answer: B. /etc/sysconfig/Jenkins
When configuring Jenkins to authenticate with AWS services, credentials such as access key ID and secret key are typically stored in the Jenkins configuration file located at /etc/sysconfig/jenkins. This file contains environment variables and configuration parameters that Jenkins reads at startup, making it the appropriate location for AWS credential parameters and region configuration when integrating with AWS Secret Manager.
Why the other options are wrong
- A. filebeat.yml is a configuration file for Filebeat (log shipping), not Jenkins AWS credentials.
- C. /etc/file/Jenkins is not a valid Jenkins configuration path.
- D. /etc/sysconfig file/Jenkins is not a valid file path syntax.
Question 2
Gabriel Bateman has been working as a DevSecOps engineer in an IT company that develops virtual classroom software for online teaching. He would like to clone the BDD security framework on his local machine using the following URL, https://github.com/continuumsecurity/bdd-security.git.
Which of the following command should Gabriel use to clone the BBD security framework?
Show answer and explanation
Correct answer: A. git clone https://github.com/continuumsecurity/bdd-security.git
The correct git command to clone a repository is 'git clone' followed by the repository URL. Option A uses the correct command syntax 'git clone' with the proper GitHub URL containing the correct repository name 'bdd-security'. This is the standard Git command for cloning remote repositories to a local machine.
Why the other options are wrong
- B. This option uses 'continumsecurity' instead of 'continuumsecurity', which is an incorrect GitHub organization name.
- C. 'github clone' is not a valid Git command; the correct command is 'git clone'.
- D. 'github clone' is not a valid Git command, and the organization name is also misspelled as 'continuumsecurity'.
Question 3
William Edwards is working as a DevSecOps engineer at SVR Software Solution Pvt. Ltd. His organization develops software products and applications related to digital marketing. William integrated Prisma Cloud with Jenkins to detect threat-intelligence based threat detection. This integration will allow him to scan container images and serverless functions for security issues in the CI/CD pipeline.
Which of the following is employed by Prisma Cloud to understand the normal network behavior of each customer’s cloud environment to detect network anomalies and zer-ay attacks effectively with minimal false positives?
Show answer and explanation
Correct answer: A. Advanced unsupervised machine learning
Prisma Cloud employs advanced unsupervised machine learning to establish baseline patterns of normal network behavior specific to each customer's cloud environment. Unsupervised learning algorithms identify anomalies by detecting deviations from learned normal behavior patterns without requiring labeled training data, enabling effective detection of zero-day attacks and network anomalies with minimal false positives.
Why the other options are wrong
- B. Supervised data mining requires labeled training data and is not the appropriate method for establishing baseline behavior patterns in dynamic cloud environments.
- C. Supervised machine learning requires pre-labeled data and is not suitable for detecting unknown zero-day attacks and novel network anomalies.
- D. Supervised data mining is not the correct approach; Prisma Cloud uses machine learning, not data mining, and it employs unsupervised rather than supervised techniques.
Question 4
Terry Crews has been working as a DevSecOps engineer at an IT company that develops software products and web applications related to IoT devices. She integrated Sqreen RASP tool with Slack for sending notifications related to security issues to her team.
How can Sqreen send notification alerts to Slack?
Show answer and explanation
Correct answer: B. By creating a playbook, defining a trigger, security response, and notification
Sqreen RASP sends notifications to Slack by creating a playbook, which defines the workflow for handling security events. The process involves defining a trigger (the security event that activates the workflow), specifying a security response (the action to take), and configuring notification settings (how and where to send alerts). This playbook-based architecture enables automated security response and alerting to integrated platforms like Slack.
Why the other options are wrong
- A. A 'cookbook' is not the correct terminology for Sqreen's security event workflows; Sqreen uses 'playbooks'.
- C. While 'playbook' and 'security response' and 'notification' are correct, the first term should be 'playbook' not 'cookbook'.
- D. The term 'Alert a response' is incorrect; Sqreen uses 'security response' to define the action taken when a trigger event occurs.
Question 5
Richard Branson has been working as a DevSecOps engineer in an IT company that develops apps for Android mobiles. To manage the secret information of an application in various phases of development lifecycle and to provide fine-grained access to each secret, he would like to integrate HashiCorp Vault with Jenkins. To access the vault from Jenkins, Richard installed hashicorp-vault-plugin and ran a vault instance; he then selected the AppRole authentication method, which allows apps to access vault with a predefined role.
Which of the following commands should Richard use to enable AppRole authentication?
Show answer and explanation
Correct answer: B. vault auth enable approle
The correct HashiCorp Vault command syntax to enable AppRole authentication is 'vault auth enable approle'. This command follows Vault's CLI structure where 'vault' is the command, 'auth' is the subcommand, 'enable' is the action, and 'approle' is the authentication method to enable. This allows applications like Jenkins to authenticate to Vault using predefined AppRole credentials.
Why the other options are wrong
- A. 'enable auth vault approle' uses incorrect command word order and is not valid Vault syntax.
- C. 'enable vault auth approle' places the words in the wrong sequence; the correct order is 'vault auth enable approle'.
- D. 'auth vault enable approle' has the command structure reversed and does not follow Vault CLI conventions.
Question 6
Rachel Maddow has been working at RuizSoft Solution Pvt. Ltd. for the past 7 years as a senior DevSecOps engineer. To develop software products quickly and securely, her organization has been using AWS DevOps services. On January 1, 2022, the software development team of her organization developed a spring boot application with microservices and deployed it in AWS EC2 instance.
Which of the following AWS services should Rachel use to scan the AWS workloads in EC2 instance for security issues and unintended network exposures?
Show answer and explanation
Correct answer: C. AWS Inspector
AWS Inspector is the AWS service specifically designed to scan EC2 instances and other AWS workloads for security vulnerabilities, unintended network exposures, and compliance issues. It performs automated security assessments and provides detailed findings about security gaps, making it the appropriate tool for identifying security issues in EC2 instances running applications.
Why the other options are wrong
- A. AWS WAF (Web Application Firewall) protects web applications from attacks but does not scan EC2 instances for security vulnerabilities.
- B. Amazon CloudWatch monitors and logs metrics but is not designed for security vulnerability scanning of EC2 instances.
- D. AWS Config tracks configuration changes and compliance but does not perform vulnerability scanning of EC2 instances.
Question 7
GainInsights is an IT company that develops mobile applications software. On February 11, 2022, the organization became a victim of a cyber-attack. The attacker targeted the organization’s application and compromised some important functionality. After the incident, the DevSecOps team of GainInsights identified the cause of the security issue, resolved it, and noted it for future reference. Based on this information, which of the following set of tests was conducted by GainInsights?
Show answer and explanation
Correct answer: D. Blameless post-mortem
A blameless post-mortem is the process conducted after a security incident where the team identifies the root cause of the security issue, documents the findings, and creates notes and action items for future prevention without assigning blame to individuals. This matches the described scenario where GainInsights identified the cause, resolved it, and documented it for future reference following a cyberattack.
Why the other options are wrong
- A. Security smoke tests are quick validation tests run during development to catch obvious failures, not post-incident investigation processes.
- B. Security acceptance tests verify that security requirements are met before deployment, not conducted after an incident has occurred.
- C. White box testing involves code-level security analysis but does not describe the post-incident documentation and root cause analysis process.
Question 8
Kevin Williamson is working as a DevSecOps engineer in an IT company located in Los Angles, California. His team has integrated Jira with Jenkins to view every issue on Jira, including the status of the latest build or successful deployment of the work to an environment.
Which of the following can Kevin use to search issues on Jira?
Show answer and explanation
Correct answer: B. Jira query language
Jira Query Language (JQL) is the search language used in Jira to search, filter, and retrieve issues based on specific criteria. When Jenkins is integrated with Jira, JQL can be used to construct queries that find issues matching particular conditions, status, project, or other attributes, allowing Kevin to search and view issues on Jira.
Why the other options are wrong
- A. Java Query Language does not exist; while Jira uses Java, there is no such query language by this name.
- C. Structured Query Language (SQL) is used for databases, not for searching Jira issues.
- D. Atlassian Query Language is not the correct name; Atlassian's search language for Jira is called Jira Query Language.
Question 9
William Friedkin has been working as a DevSecOps engineer in an IT company for the past 3 years. His team leader has asked him to validate the host configuration that runs the Docker containers and perform security checks at the container level by implementing Docker’s CIS Benchmark Recommendations. Therefore, William would like to integrate Docker Bench with Jenkins to incorporate security testing in DevOps workflow and secure the Docker Container. Before starting the procedure, he would like to install openssh on Ubuntu.
Which of the following command should William run to install openssh on Ubuntu?
Show answer and explanation
Correct answer: B. sudo apt-get install openssh-server
The correct command to install openssh-server on Ubuntu is sudo apt-get install openss-erver. The apt-get command is the package manager for Ubuntu-based systems, and 'install' is the proper subcommand to use without any additional flags for a standard installation.
Why the other options are wrong
- A. The -s flag is used for simulation mode and does not actually install the package.
- C. apt.get is not a valid command; the correct syntax is apt-get with a hyphen, not a period.
- D. This combines two errors: apt.get is invalid syntax and the -s flag performs only a simulation.
Question 10
William O’Neil has been working as a senior DevSecOps engineer in an IT company that develops software products related to ecommerce. At this point in time, his team is working on securing a python-based application. Using GitGraber, William would like to detect sensitive information in real-time in his organizational GitHub repository. Therefore, he downloaded GitGraber and installed the dependencies.
Which of the following commands should William use to find secrets using a keyword (assume the keyword is yahoo)?
Show answer and explanation
Correct answer: D. python3 gitGraber.py -w wordlist/keywordsfile.txt -q “yahoo” -s
“yahoo” -s The correct GitGraber command syntax uses the -w flag to specify the wordlist file containing keywords, making the command python3 gitGraber.py -w wordlist/keywordsfile.txt -q "yahoo" -s. The -w parameter designates the path to the keywords file that GitGraber will use to search for secrets matching those keywords in the repository.
Why the other options are wrong
- A. The -p flag is not the correct parameter for specifying keywords in GitGraber.
- B. The -g flag does not correspond to the wordlist parameter in GitGraber's syntax.
- C. The -k flag is not used for specifying the keywords file path in GitGraber.
That was 10 of 100.
The full EC-Council 312-97 ECDE pack has all 100 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.