最新的ECCouncil EC-Council Certified DevSecOps Engineer (ECDE) - 312-97免費考試真題
Charles Rettig, a DevSecOps engineer at an IT company specializing in IoT software and web applications, is responsible for ensuring the security of web applications deployed across various devices. To automate security testing, Charles integrates Burp Suite with Jenkins using the Command Line Interface (CLI) to Identify vulnerabilities in web applications. During a security audit, Charles realizes that traditional security scanning approaches often produce false positives and fail to detect vulnerabilities that only appear during real-time interactions. To address this issue, he enables a Burp Suite feature that minimizes false positives. Which Burp Suite feature helps Charles detect invisible vulnerabilities while minimizing false positives?
正確答案: C
說明：（僅 Fast2test 成員可見）
A technology firm specializing in financial services has integrated Fortify Static Code Analyzer (SCA) with Jenkins to enforce secure coding practices within its CI/CD pipeline. The objective is to identify and remediate vulnerabilities early in the development lifecycle. After a recent build, the security team noticed that critical vulnerabilities were not flagged, despite Fortify SCA being executed within the pipeline. Jenkins logs confirmed that the scan completed successfully without any errors. However, when the security team manually executed Fortify SCA on the same codebase outside of Jenkins, multiple vulnerabilities were detected. Which of the following is the reason for the discrepancy in vulnerability detection?
正確答案: C
說明：（僅 Fast2test 成員可見）
Sophia, a DevSecOps engineer, is responsible for setting up a multi-environment application infrastructure using AWS CloudFormation. She wants to streamline the deployment process by reusing templates to replicate infrastructure stacks across development, staging, and production environments. However, when attempting to create the production stack, she encounters a failure due to exceeding AWS resource quotas for certain services. To prevent such issues in future deployments, Sophia must adopt a proactive strategy while maintaining best practices for managing CloudFormation templates and stacks. Which approach should Sophia take to address the issue and ensure smooth stack creation across environments?
正確答案: B
說明：（僅 Fast2test 成員可見）
George Lennon is working as at InfoWorld Pvt. Solution as a DevSecOps engineer. His colleague, Sarah Mitchell, is a senior software developer. George told her to participate in a bug bounty program conducted by AWS for python and Java code developers. He informed Sarah that the challenge is a fun-based solution for bashing bugs, encouraging team building, and bringing friendly competition to enhance the quality of the code and application performance.
Acting on George's advice, Sarah participated in the bug bounty program and scored the highest points in the challenge, and she received a reward of $10,000. Based on the given information, which of the following bug bounty programs did Sarah participate?
Acting on George's advice, Sarah participated in the bug bounty program and scored the highest points in the challenge, and she received a reward of $10,000. Based on the given information, which of the following bug bounty programs did Sarah participate?
正確答案: C
說明：（僅 Fast2test 成員可見）
Cindy Williams has recently joined an IT company as a DevSecOps engineer. She configured Bundle-Audit in Travis CI. Cindy detected vulnerability in Gemfile dependencies and resolved it by adding some line of codes. How does Bundler scan Gemfile.lock for insecure versions of gems?
正確答案: B
說明：（僅 Fast2test 成員可見）
David, a DevSecOps engineer, is responsible for ensuring the security of his organization's software development lifecycle. During a security review, he notices that developers often embed API keys, database credentials, and other sensitive information directly into the application's source code. David warns that hardcoding credentials poses a serious security risk because attackers could extract sensitive information from leaked or publicly exposed repositories, and unauthorized access to critical systems could occur if credentials are compromised. To address this risk, David recommends implementing a secure system that allows applications to dynamically retrieve sensitive information at runtime without hardcoding them in the source code. Which of the following practices should be implemented to prevent developers from hardcoding secrets in the application's source code?
正確答案: D
說明：（僅 Fast2test 成員可見）
A SaaS company recently experienced a security incident where an ethical hacker privately disclosed a vulnerability that allowed unauthorized access to sensitive customer data. Although the issue was patched quickly, the company realized that they lacked a structured program to encourage responsible vulnerability disclosure, manage security reports from ethical hackers efficiently and incentivize researchers to responsibly report security flaws. To address this gap, the company decides to implement a widely recognized vulnerability reporting program that supports Google and third-party applications while providing bounties or recognition for security disclosures. Which initiative should the company adopt?
正確答案: A
說明：（僅 Fast2test 成員可見）
Andrew Gerrard has recently joined an IT company located in Fairmont, California, as a DevSecOps engineer. Due to robust security and cost-effective service provided by AWS, his organization has migrated all the workloads from on-prem to AWS cloud in January of 2020.
Andrew's team leader has asked him to integrate AWS Secret Manager with Jenkins. To do so, Andrew installed the "AWS Secret Manager Credentials provider" plugin in Jenkins and configured an IAM policy in AWS that allows Jenkins to take secrets from AWS Secret manager.
Which of the following file should Andrew edit to add access id and secret key parameters along with the region copied from AWS?
Andrew's team leader has asked him to integrate AWS Secret Manager with Jenkins. To do so, Andrew installed the "AWS Secret Manager Credentials provider" plugin in Jenkins and configured an IAM policy in AWS that allows Jenkins to take secrets from AWS Secret manager.
Which of the following file should Andrew edit to add access id and secret key parameters along with the region copied from AWS?
正確答案: C
說明：（僅 Fast2test 成員可見）