EC-Council ECDE (312-97) Certification Sample Questions
The purpose of this Sample Question Set is to provide you with information about the EC-Council Certified DevSecOps Engineer exam. These sample questions will make you very familiar with both the type and the difficulty level of the questions on the 312-97 certification test. To get familiar with real exam environment, we suggest you try our Sample EC-Council ECDE Certification Practice Exam. This sample practice exam gives you the feeling of reality and is a clue to the questions asked in the actual EC-Council Certified DevSecOps Engineer (ECDE) certification exam.
These sample questions are simple and basic questions that represent likeness to the real EC-Council 312-97 exam questions. To assess your readiness and performance with real time scenario based questions, we suggest you prepare with our Premium EC-Council ECDE Certification Practice Exam. When you solve real time scenario based questions practically, you come across many difficulties that give you an opportunity to improve.
EC-Council 312-97 Sample Questions:
01. A company patches every managed instance with an automated, risk-prioritized process that tests patches before rollout, and its patch compliance dashboard shows 100%. An attacker nevertheless compromised a months-old unpatched VM that another team had launched from an old image and never registered with the patching service.
Which weakness allowed this breach?
a) Patches were rolled out without being tested first, so some failed to install
b) Patches were not prioritized by risk before being rolled out
c) The asset inventory was incomplete, so machines outside the managed fleet were invisible to patching
d) The patch window was too infrequent to keep up with critical releases
02. A critical injection flaw is found in the search parameter of a legacy web application. The code fix will take three weeks to develop and test. The WAF in front of the application runs managed rule sets, but testers confirm the specific payload for this flaw passes through them, and exploitation attempts are already in the logs.
What should the team do while the fix is developed?
a) Hotfix the code directly on the production servers, outside the pipeline, to close the flaw today
b) Add a custom WAF rule that blocks requests exploiting that parameter until the fix ships
c) Enable rate limiting on the search endpoint to slow the attackers down
d) Keep relying on the managed rule sets, since they cover common injection attacks
03. A Jenkins job's configuration was changed last week so that it skips the SAST stage. Role-based authorization is in place, but nobody can tell which of the users with configuration rights made the change.
What should the team enable so that changes like this can be investigated in future?
a) Matrix-based authorization granting job configuration rights to fewer users
b) Running the job's builds on agents and off the controller
c) An audit trail that records which user changed each job or configuration setting
d) Moving the job's credentials into the Credentials store and a vault
04. A service is designed to run across three availability zones with automatic failover, but the failover has not been exercised since launch. The team wants evidence that the service keeps working when instances or a zone fail.
Which practice provides this evidence?
a) Chaos engineering experiments that deliberately terminate instances to confirm the service recovers
b) Load testing that ramps traffic up to twice the expected peak
c) Synthetic probes that check the service endpoint from outside every minute
d) Test restores of the database backups each quarter
05. A threat detection service alerts that an EC2 instance in an auto-scaling group is communicating with a known cryptocurrency-mining pool. The security team must stop the activity and keep evidence for a forensic investigation.
What should the responder do FIRST?
a) Terminate the instance right away, and let the auto-scaling group launch a clean replacement from the same image
b) Detach it from the auto-scaling group, isolate it in a restrictive security group and snapshot its disk
c) Isolate it in a restrictive security group, then terminate it as soon as its traffic to the mining pool stops
d) Leave the instance running unchanged and connected while analysts work through a month of its CloudTrail history
06. An Azure security team needs a cloud-native SIEM that collects security events from across its subscriptions, correlates them into incidents and runs automated response playbooks.
Which Azure service provides this?
a) Microsoft Sentinel
b) Azure Monitor with Application Insights
c) Azure Key Vault with access logging
d) Azure Policy assignments
b) Azure Monitor with Application Insights
c) Azure Key Vault with access logging
d) Azure Policy assignments
07. An online store's checkout failed at 3 a.m. and the team learned of it from customer complaints in the morning. Server CPU and memory metrics stayed healthy all night, because the failure was in a call to a third-party payment service.
Which monitoring practice would have detected this failure before customers reported it?
a) Audit logging of API calls made to the cloud account, reviewed each morning
b) A web application firewall in front of checkout with managed rules, logging each blocked request to the SIEM
c) Additional CPU and memory alarms on the application servers with lower thresholds
d) Scripted synthetic probes that run the checkout journey against the live site from outside
08. An operations team runs Docker Bench against its container hosts. The tool checks host settings, Docker daemon configuration and container runtime options against a published set of consensus-based hardening recommendations.
Which reference does Docker Bench check against?
a) The OWASP ASVS
b) The CIS Docker Benchmark
c) The CVE list of known vulnerabilities
d) The OWASP Top 10
b) The CIS Docker Benchmark
c) The CVE list of known vulnerabilities
d) The OWASP Top 10
09. In an AWS account, storage buckets are occasionally made public through console changes made between pipeline runs. A scheduled InSpec scan catches them overnight, but the buckets stay exposed for hours first. The team wants non-compliant buckets evaluated as the change happens and corrected without waiting for a person.
Which approach meets this requirement?
a) AWS Config rules evaluating bucket settings continuously, with automatic remediation of non-compliant buckets
b) A Checkov scan of the Terraform files on every pull request
c) Running the InSpec profile hourly and emailing the results to the owners
d) CloudTrail event history reviewed daily for bucket policy changes
10. Within ten minutes, the VPN log shows a login for user jlee from an unusual country, the cloud IAM log shows jlee creating a new access key, and the storage access log shows large downloads using that key. Each source's own alert rule rated its event as low severity, so no one responded.
Which capability would have surfaced these events as a single incident?
a) Synthetic probes that test the VPN and storage endpoints from outside every minute
b) Uptime dashboards built from Prometheus metrics for the VPN, IAM and storage services
c) SIEM correlation rules linking events across sources
d) Higher alert thresholds on each log source
Answers:
|
Question: 01 Answer: c |
Question: 02 Answer: b |
Question: 03 Answer: c |
Question: 04 Answer: a |
Question: 05 Answer: b |
|
Question: 06 Answer: a |
Question: 07 Answer: d |
Question: 08 Answer: b |
Question: 09 Answer: a |
Question: 10 Answer: c |
Note: For any error in EC-Council Certified DevSecOps Engineer (ECDE) (312-97) certification exam sample questions, please update us by writing an email on feedback@edusum.com.
