(Cindy Williams has recently joined an IT company as a DevSecOps engineer. She configured Bundle- Audit in Travis CI. Cindy detected vulnerability in Gemfile dependencies and resolved it by adding some line of codes. How does Bundler scan Gemfile.lock for insecure versions of gems?)
Answer(s): C
Bundler-Audit is a Software Composition Analysis (SCA) tool designed specifically for Ruby applications. It scans the Gemfile and Gemfile.lock to identify all declared dependencies and their resolved versions. The Gemfile specifies which gems the application depends on, while the Gemfile.lock ensures consistent dependency versions across environments. Bundler-Audit compares this dependency information against a database of known vulnerabilities to identify insecure or outdated gems. It does not rely on the Travis CI configuration file for vulnerability detection, nor does it compare against unknown vulnerabilities. Integrating Bundler-Audit into the Build and Test stage ensures that vulnerable third-party libraries are detected early, allowing developers to remediate issues before the application progresses further in the pipeline. This practice supports shift-left security and reduces the risk of introducing known vulnerabilities into production systems.
(Gabriel Jarret has been working as a senior DevSecOps engineer in an IT company located in Houston, Texas. He is using Vault to manage secrets and protect sensitive data. On February 1, 2022, Gabriel wrote the secret using vault kv put secret/wejskt command. On February 10, 2022, his team detected a brute-force attack using Splunk monitoring tool. Gabriel would like to delete the secrets in the vault that he wrote on February 1, 2022. Which of the following commands should Gabriel use to delete a secret in Vault secret management tool?)
Answer(s): B
HashiCorp Vault provides a key-value (KV) secrets engine for securely storing sensitive data. To remove a secret from the KV store, the correct command is vault kv del <path>. This command deletes the secret data at the specified path. Options using -delete or -del are syntactically incorrect, and vault kv delete is not a valid Vault CLI command. Proper secret deletion is an essential part of secret lifecycle management, especially when credentials may have been compromised. Performing this action during the Operate and Monitor stage helps contain security incidents, reduce exposure, and ensure that compromised secrets are no longer accessible. Timely deletion of secrets supports effective incident response and strengthens overall security posture.
(Kevin Williamson is working as a DevSecOps engineer in an IT company located in Los Angles, California. His team has integrated Jira with Jenkins to view every issue on Jira, including the status of the latest build or successful deployment of the work to an environment. Which of the following can Kevin use to search issues on Jira?)
Jira uses Atlassian Query Language, commonly referred to as JQL, to search, filter, and manage issues. This query language allows users to create advanced searches using fields such as project, status, assignee, priority, and custom attributes. Although often informally called Jira Query Language, the official name among the given options is Atlassian Query Language. SQL and Java query language are unrelated and not used for issue searching in Jira. Using JQL during the Code stage improves traceability between source code commits, builds, and tracked issues, enabling teams to monitor progress, validate deployment status, and maintain alignment between development and delivery activities.
(Charles Rettig has been working as a DevSecOps engineer in an IT company that develops software and web applications for IoT devices. He integrated Burp Suite with Jenkins to detect vulnerabilities and evaluate attack vectors compromising web applications. Which of the following features offered by Burp Suite minimizes false positives and helps detect invisible vulnerabilities?)
Answer(s): A
Burp Suite's Out-of-band Application Security Testing (OAST) feature is designed to detect vulnerabilities that do not produce immediate or visible responses during standard scanning. OAST works by triggering interactions such as DNS or HTTP callbacks, which occur outside the normal request-response cycle. This capability enables detection of blind vulnerabilities like blind SQL injection and server-side request forgery. Because findings are based on confirmed external interactions, OAST significantly reduces false positives. The other options listed are not valid Burp Suite features. Integrating OAST during the Build and Test stage improves the accuracy of dynamic security testing and ensures deeper coverage of complex and hard-to-detect vulnerability classes before applications are released.
(Cheryl Hines has been working as a senior DevSecOps engineer over the past 5 years in an IT company. Due to the robust features offered by Keywhiz secret management tool such as compatibility with all software, untraceable secrets, no impact of power cut or server outage, etc., Cheryl's organization is using it for managing and distributing secrets. To add a secret using Keywhiz CLI, which of the following commands should Cheryl use?)
Keywhiz CLI requires authentication before secrets can be added. The correct process involves logging in using the --devTrustStore option and authenticating as an administrator using the --admin flag. Once authenticated, the add secret command is used with input redirection to securely store the secret. Options that use incorrect flag names, incorrect casing, or invalid trust store identifiers do not follow Keywhiz CLI syntax. Adding secrets through Keywhiz instead of embedding them in code supports secure secret distribution and management, which is a fundamental aspect of DevSecOps culture. This approach ensures secrets remain protected, auditable, and available even during outages.
Post your Comments and Discuss EC-Council 312-97 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 312-97 content, but please register or login to continue.