Exam: 312-97
|
|||||||||||||||||||||||||||
The 312-97 exam is for the EC-Council Certified DevSecOps Engineer (ECDE)
certification, featuring 100 multiple-choice questions, a 4-hour time limit, and
requiring a 70% score to pass, testing skills in secure software pipelines,
automation, container security, and cloud security with scenario-based
questions. It's delivered online via the EC-Council portal and assesses
practical application of DevSecOps principles in modern development
environments, focusing on moving security left in the CI/CD process.
Key Exam Details
Exam Code: 312-97
Title: EC-Council Certified DevSecOps Engineer (ECDE)
Format: Multiple Choice
Questions: 100
Duration: 4 Hours
Passing Score: 70%
Delivery: Online via EC-Council's exam portal
Topics Covered
Secure design principles & cryptographic implementation
Application security testing & containerization security
Orchestration security & configuring security tools in automated pipelines
Cloud security (AWS examples mentioned) & continuous security monitoring
Shift-left security & securing the entire software pipeline
Here's a breakdown of key topics:
Secure Coding & Development: Static analysis (SAST), secure coding
guidelines, secret detection (GitGraber).
Build & Test Integration: Automated security testing (SAST, DAST, IAST), CI
pipelines, security policy as code (SPACK).
Release & Deployment: Infrastructure as Code (IaC) security (Terraform,
CloudFormation), container security (Docker Bench), secure deployment, release
management.
Operations & Monitoring: Logging, monitoring, incident detection, SIEM tools,
runtime security.
What to Expect
Scenario-Based Questions: Expect questions requiring you to apply knowledge
to realistic DevSecOps challenges, not just definitions.
Tool Integration: Focus on understanding how to integrate security tools (like
Azure Key Vault, AWS services) into CI/CD workflows.
Cultural Aspects: The exam also touches on the human and organizational side of
successful DevSecOps adoption.
312-97 Brain Dumps Exam + Online / Offline and Android Testing Engine & 4500+ other exams included
$50 - $25 (you save $25)
Buy Now
QUESTION 1
(William Scott, after completing his graduation in computer science, joined
an IT company as a
DevSecOps engineer. His team leader has asked him to use GitHub Code Scanning
for evaluating the
source code in his organizations GitHub repository to detect security issues and
coding errors.
How can William set up coding scanning in GitHub repository?)
A. By using Gauntlt.
B. By using GitMiner.
C. By using OWASP ZAP.
D. By using CodeQL.
Answer: D
Explanation:
GitHub Code Scanning is a built-in security capability designed to automatically
analyze source code
for security vulnerabilities and coding errors. The primary and officially
supported engine for GitHub
Code Scanning is CodeQL. CodeQL works by converting source code into a database
and running
security queries to detect issues such as injection flaws, insecure coding
patterns, and logic errors.
William can enable CodeQL by configuring GitHub Actions with either the default
or advanced
CodeQL workflow. Once enabled, CodeQL scans are triggered on events such as code
pushes and pull
requests, and the results appear as code scanning alerts in the repositorys
Security tab. Gauntlt is a
security testing harness used mainly for infrastructure and application testing,
GitMiner is used to
discover sensitive data like secrets in repositories, and OWASP ZAP is a dynamic
application security
testing tool used against running applications. None of these tools configure
GitHubs native Code
Scanning feature. Therefore, CodeQL is the correct tool to set up GitHub Code
Scanning in the Code
stage of a DevSecOps pipeline.
QUESTION 2
(Brett Ryan has been working as a senior DevSecOps engineer in an IT company in
Charleston, South Carolina.
He is using git-mutimail tool to send email notification for every push to git
repository. By default, the tool will send one output email providing details
about
the reference change and one output
email for every new commit due to a reference change. How can Brett ensure that
git-multimail is set up appropriately?)
A. Running the environmental variable GITHUB_MULTIMAIL_CHECK_SETUP by setting it
to nonempty string.
B. Running the environmental variable GIT_MULTIMAIL_CHECK_SETUP by setting it to
empty string.
C. Running the environmental variable GIT_MULTIMAIL_CHECK_SETUP by setting it to
non-empty string.
D. Running the environmental variable GITHUB_MULTIMAIL_CHECK_SETUP by setting it
to empty string.
Answer: C
Explanation:
The git-multimail tool provides a mechanism to verify whether it has been
installed and configured
correctly before being relied upon for production notifications. This
verification is done using an
environment variable named GIT_MULTIMAIL_CHECK_SETUP. When this variable is set
to a nonempty
string, git-multimail performs a setup validation and outputs diagnostic
information to
confirm that configuration values, hooks, and parameters are correctly defined.
This helps prevent
silent failures where commits occur but email notifications are not sent.
Options that reference
GITHUB_MULTIMAIL_CHECK_SETUP are incorrect because git-multimail is not limited
to GitHub and
does not use that variable name. Additionally, setting the variable to an empty
string does not trigger
the setup check. Ensuring proper configuration during the Code stage is
important because it
supports auditability, traceability, and timely communication among development
and security
teams. Therefore, Brett must run the environment variable
GIT_MULTIMAIL_CHECK_SETUP with a
non-empty value to ensure the tool is set up appropriately.
QUESTION 3
(BVR Pvt. Ltd. is an IT company that develops software products and applications
related to IoT
devices. The software development team of the organization is using Bitbucket
repository to plan
projects, collaborate on code, test, and deploy. The repository provides teams a
single place for
projects planning and collaboration on coding, testing, and deploying the
software application.
Which of the following is offered by Bitbucket to BVR Pvt. Ltd.?)
A. Free limited public repositories.
B. Free unlimited private repositories.
C. Free limited private repositories.
D. Free unlimited public repositories.
Answer: B
Explanation:
Bitbucket provides a cloud-based source code management platform that supports
collaboration,
CI/CD integration, and secure code hosting. One of the key features offered by
Bitbucket is free
unlimited private repositories, particularly beneficial for organizations
developing proprietary
software such as IoT applications. This allows teams to store source code
securely without exposing it
publicly while still enabling collaboration features like pull requests, issue
tracking, and pipeline
automation. The term oelimited private repositories is inaccurate because
Bitbucket does not restrict
the number of private repositories under its free offering; rather, user count
limits apply. While
Bitbucket also supports public repositories, the option that best represents its
value to enterprise
and product-based teams is unlimited private repositories. This capability
aligns with DevSecOps
practices by ensuring confidentiality of source code while enabling integrated
planning, testing, and
deployment workflows within a single platform.
QUESTION 4
(Erica Mena has been working as a DevSecOps engineer in an IT company that
provides customize
software solutions to various clients across United States. To protect
serverless and container
applications with RASP, she would like to create an Azure container instance
using Azure CLI in
Microsoft PowerShell. She created the Azure container instance and loaded the
container image to it.
She then reviewed the deployment of the container instance. Which of the
following commands
should Erica run to get the logging information from the Azure container
instance? (Assume the
resource group name as ACI and container name as aci-test-closh.))
A. az get container logs -resource-group ACI --name aci-test-closh.
B. az get container logs --resource-group ACI --name aci-test-closh.
C. az container logs -resource-group ACI -name aci-test-closh.
D. az container logs --resource-group ACI --name aci-test-closh.
Answer: D
Explanation:
Azure Container Instances provide built-in logging capabilities that can be
accessed using the Azure
CLI. To retrieve logs from a deployed container instance, the correct command is
az container logs
followed by the resource group and container name. The proper syntax requires
double-dash
parameters: --resource-group and --name. In Ericas case, the correct command is
az container logs --
resource-group ACI --name aci-test-closh. Options that use oeaz get container
logs are invalid
because oeget is not a supported verb in this context. Option C uses incorrect
single-dash flags, which
do not match Azure CLI standards. Accessing container logs during the Code stage
helps engineers
validate application behavior, identify runtime errors, and ensure that security
instrumentation such
as RASP agents are functioning correctly before progressing further in the
pipeline.
QUESTION 5
(Walter OBrien recently joined as a junior DevSecOps engineer in an IT company
located in Lansing,
Michigan. His organization develops robotic process automation software for
various clients
stretched across the globe. Walters team leader asked him to configure username
and user email for
git in VS Code. Therefore, he opened Visual Studio Code IDE console, then
clicked on Terminal tab
and selected New terminal. Which of the following command should Walter execute
in the terminal
to configure username and user email for git in VS Code?)
A. get config --global user-name oewalter username for git
get config -“global user-email oewalter email address used for git .
B. get config --global user.name oewalter username for git
get config “global user.email oewalter email address used for git .
C. get git config --global user.name oewalter username for git
get git config “global user.email oewalter email address used for git .
D. get config --global user_name oewalter username for git
get config -“global user_email oewalter email address used for git .
Answer: B
Explanation:
Git requires developers to configure their identity using two specific
configuration keys: user.name
and user.email. These values are embedded into every commit and are essential
for accountability,
auditing, and collaboration. The correct configuration syntax uses dot-separated
key names
(user.name and user.email) and the --global flag to apply the settings across
all repositories on the
system. Among the provided options, only option B uses the correct configuration
keys. The other
options use invalid key names such as user-name, user_name, or incorrect command
structure.
Although the options display a minor command typo (oeget config instead of git
config), the question
is clearly testing knowledge of the correct Git configuration keys. Configuring
Git identity in the Code
stage ensures accurate commit history and supports traceability across the
DevSecOps pipeline.
Buy Complete
Students Feedback / Reviews/ Discussion
Mahrous Mostafa Adel Amin 1 week, 2 days ago - Abuhib- United Arab
Emirates
Passed the exam today, Got 98 questions in total, and 2 of them weren’t from
exam topics. Rest of them was exactly the same!
upvoted 4 times
Mbongiseni Dlongolo - South Africa2 weeks, 5 days ago
Thank you so much, I passed 312-97 today! 41 questions out of 44 are from
Certkingdom
upvoted 2 times
Kenyon Stefanie 1 month, 1 week ago - USA State / Province = Virginia
Thank you so much, huge help! I passed 312-97 EC-Council today! The big majority
of questions were from here.
upvoted 2 times
Danny 1 month, 1 week ago - United States CUSTOMER_STATE_NAME: Costa Mesa =
USA
Passed the exam today, 100% points. Got 44 questions in total, and 3 of them
weren’t from exam topics. Rest of them was exactly the same!
MENESES RAUL 93% 2 week ago - USA = Texas
was from this topic! I did buy the contributor access. Thank you certkingdom!
upvoted 4 times
Zemljaric Rok 1 month, 2 weeks ago - Ljubljana Slovenia
Cleared my exam today - Over 80% questions from here, many thanks certkingdom
and everyone for the meaningful discussions.
upvoted 2 times
logged members Can Post comments / review and take part in Discussion
Certkingdom Offline Testing Engine Simulator Download
Prepare with yourself how CertKingdom Offline Exam Simulator it is designed specifically for any exam preparation. It allows you to create, edit, and take practice tests in an environment very similar to an actual exam.
Supported Platforms: Windows-7 64bit or later - EULA | How to Install?
FAQ's: Windows-8 / Windows 10 if you face any issue kinldy uninstall and reinstall the Simulator again.
Download Offline Simulator-Beta
Certkingdom Testing Engine Features
- Certkingdom Testing Engine simulates the real exam environment.
- Interactive Testing Engine Included
- Live Web App Testing Engine
- Offline Downloadable Desktop App Testing Engine
- Testing Engine App for Android
- Testing Engine App for iPhone
- Testing Engine App for iPad
- Working with the Certkingdom Testing Engine is just like taking the real tests, except we also give you the correct answers.
- More importantly, we also give you detailed explanations to ensure you fully understand how and why the answers are correct.
Certkingdom Android Testing Engine Simulator Download
Take your learning mobile android device with all the features as desktop offline testing engine. All android devices are supported.
Supported Platforms: All Android OS EULA
Install the Android Testing Engine from google play store and download the app.ck from certkingdom website android testing engine download
Certkingdom Android Testing Engine Features
- CertKingdom Offline Android Testing Engine
- Make sure to enable Root check in Playstore
- Live Realistic practice tests
- Live Virtual test environment
- Live Practice test environment
- Mark unanswered Q&A
- Free Updates
- Save your tests results
- Re-examine the unanswered Q & A
- Make your own test scenario (settings)
- Just like the real tests: multiple choice questions
- Updated regularly, always current
