Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
(Maria Howell is working as a senior DevSecOps engineer at Global SoftSec Pvt. Ltd. Her team is currently working on the development of a cybersecurity software. There are 5 developers who are working on code development. Howell's team is using a private GitHub repository for the source code development. Which of the following commands should Howell use to grab the online updates and merge them with her local work?.)
The git pull command is used to fetch changes from a remote repository and automatically merge them into the current local branch. In collaborative development environments, especially when multiple developers are committing code to a shared repository, regularly pulling updates is essential to stay synchronized and avoid merge conflicts. The syntax git pull <remote-name>
(George Lennon is working as at InfoWorld Pvt. Solution as a DevSecOps engineer. His colleague, Sarah Mitchell, is a senior software developer. George told her to participate in a bug bounty program conducted by AWS for python and Java code developers. He informed Sarah that the challenge is a fun-based solution for bashing bugs, encouraging team building, and bringing friendly competition to enhance the quality of the code and application performance. Acting on George's advice, Sarah participated in the bug bounty program and scored the highest points in the challenge, and she received a reward of $10,000. Based on the given information, which of the following bug bounty programs did Sarah participate?.)
The description matches AWS BugBust, which AWS positions as a gamified, team-based bug fixing challenge rather than a classic external ''bug bounty'' for finding vulnerabilities in AWS itself. The key hints are ''fun-based solution for bashing bugs,'' ''encouraging team building,'' and ''friendly competition,'' along with scoring points and awarding prizes. BugBust focuses on improving code quality by motivating developers to find and fix issues (often via static analysis findings) in languages like Java and Python. Participants earn points for remediations and compete on leaderboards, which aligns directly with Sarah ''scored the highest points'' and received a cash reward. The other names (BugFixer, BugFinder, BugHunt) are plausible-sounding but do not match the commonly referenced AWS gamified program described. In a DevSecOps context, this type of program supports culture by incentivizing secure coding habits, encouraging shared ownership of quality, and making remediation visible and rewarding across the engineering team.
(Kevin Ryan has been working as a DevSecOps engineer in an MNC company that develops various software products and web applications. For easy management of secret credentials in CI/CD pipeline, he would like to integrate Azure Key Vault with Jenkins. Therefore, he created an Azure Key Vault, noted down the credentials displayed on the screen, and created a secret in Azure Key Vault. Then, he used the secret key from the credentials obtained from creating the vault. Kevin went back to Jenkins and installed Azure Key Vault plugin. Then, he navigated to Configure System under Manage Jenkins and added the URL for Azure Key Vault. How can Kevin complete the integration of Azure Key Vault with Jenkins?.)
To complete Azure Key Vault integration with Jenkins, Kevin must create new credentials in Jenkins under Global Credentials (unrestricted). These credentials store the Azure client ID, client secret, tenant ID, and subscription details required by the Azure Key Vault plugin to authenticate securely. Modifying old credentials can lead to misconfiguration or credential reuse risks, while restricted credentials may prevent the plugin from accessing secrets across pipelines. Creating new unrestricted credentials ensures proper authentication and controlled access to secrets during the Code stage, supporting secure secret management across CI/CD workflows.
(Sofia Coppola has been working as a senior DevSecOps engineer in an MNC company located in Denver, Colorado. In January of 2020, her organization migrated all the workloads from on-prem to AWS cloud environment due to the robust security feature and cost-effective services offered by AWS. Which of the following is an Amazon Web Services-hosted version control tool that Sofia can use to manage and store assets in the AWS cloud?.)
AWS CodeCommit is a fully managed, AWS-hosted source control service that allows teams to store and manage source code, binaries, and other digital assets securely in the cloud. It supports Git-based repositories and integrates seamlessly with other AWS DevOps services such as CodeBuild, CodePipeline, and CodeDeploy. CodePipeline orchestrates CI/CD workflows, CodeBuild performs build and test operations, and CodeDeploy automates application deployment---but none of these are version control systems. For organizations migrating from on-prem to AWS, CodeCommit provides fine-grained access control using IAM, encryption at rest and in transit, and high availability without the need to manage infrastructure. Using CodeCommit during the Code stage supports secure collaboration, version tracking, and centralized source control aligned with DevSecOps best practices.
(Steven Gerrard has been working as a DevSecOps engineer at an IT company that develops software products and applications related to the healthcare industry. His organization has been using Azure DevOps services to securely and quickly develop software products. To ensure that the deployed infrastructure is in accordance with the architecture and industrial standards and the security policies are appropriately implemented, she would like to integrate InSpec with Azure. Therefore, after installation and configuration of InSpec, she created InSpec profile file and upgraded it with personal metadata and Azure resource pack information; then she wrote the InSpec tests. Which of the following commands should Steven use to run InSpec tests to check the compliance of Azure infrastructure?)
Chef InSpec executes compliance tests using the inspec exec command. When testing Azure infrastructure, InSpec requires a target specification using the -t flag with the Azure transport identifier azure://. The correct command is inspec exec inspec-tests/integration/ -t azure://. Options using exe instead of exec are invalid due to incorrect command spelling. Options that use the -it flag misuse command-line parameters that are not intended for target selection. Running InSpec tests in this way allows DevSecOps teams to validate that Azure resources comply with architectural, security, and regulatory requirements. Integrating these checks into the Build and Test stage ensures continuous compliance and reduces the risk of insecure infrastructure reaching production environments.
100 questions covering all exam domains, starting from $20
Exam domains verified against: Official Eccouncil 312-97 exam guide, last checked August 2026.
This module covers the cultural and technical foundations of DevOps, emphasizing collaboration between development and operations teams. Key topics include automation, continuous integration and deployment (CI/CD), DevOps values and benefits, and how collaboration and feedback loops drive faster, more reliable software delivery.
Sample question from this domain above: Q2
This module introduces foundational DevSecOps concepts, focusing on integrating security into the DevOps lifecycle. It covers the shift from traditional security approaches to collaborative, automated, and continuously integrated security, with emphasis on culture, automation, monitoring, feedback loops, and tools for establishing a DevSecOps culture in organizations.
This module covers the planning phase of the DevSecOps pipeline, including identifying security requirements, conducting threat modeling, and establishing security-focused plans. It emphasizes collaboration between development, security, and operations teams to align with security goals from the start.
This module focuses on integrating security into the development process through secure coding practices. Topics include static code analysis, secure coding guidelines, and implementation of security controls within the IDE, enabling developers to write secure code using industry best practices.
Sample question from this domain above: Q1
This module explores integration of security into build and testing processes, covering automated security testing including SAST and DAST. It emphasizes the use of continuous integration pipelines to detect and address security issues early in the development cycle.
This module explains maintaining security during release and deployment phases, including secure deployment techniques, Infrastructure as Code security, and container security tools. It covers release management and secure configuration practices to ensure production safety.
This final module focuses on securing the operational environment and monitoring applications for security incidents. Topics include logging, monitoring, incident detection and response, and continuous security monitoring using SIEM tools to maintain runtime security.
Sample question from this domain above: Q5
Common questions about the exam itself
