312-97: EC-Council Certified DevSecOps Engineer (ECDE)Demo

ThreatModeler's Accelerator feature automatically scans and imports an organization's existing AWS environment/architecture to instantly generate a corresponding threat model, eliminating the need for manual diagramming. In contrast, 'Architect' is used for manually building a threat model from scratch by dragging and dropping components, and 'STRIDE per Element' is a threat-categorization technique applied within the model rather than a means of auto-generating it from a live cloud environment.

The --no-exit-on-warn option prevents Brakeman warnings from producing a failing exit status, so Brakeman returns exit code 0 even if it finds warnings. This lets Jenkins collect and report the findings without the scan itself failing the build.

In this integration pattern, AWS CodePipeline's build stage is implemented using AWS CodeBuild. CodeBuild is the fully managed build service that actually executes the Snyk CLI: it retrieves the Snyk authentication token from AWS Systems Manager Parameter Store, uses it to authenticate the Snyk CLI, and runs the scan (e.g., 'snyk test' / 'snyk monitor') against the latest code committed to the CodeCommit repository. After the scan completes, the findings are reviewable on the Snyk console (Snyk UI). CodeCommit only hosts the source code and generates the triggering event; CodeDeploy handles application deployment, not vulnerability scanning; and CodePipeline itself only orchestrates the stages — the actual interaction with the Snyk CLI happens inside the CodeBuild build stage.

Git repositories are cloned using the command git clone <repository-url>, which creates a local copy of the remote repository at the specified URL. The correct command must use the exact repository URL provided, https://github.com/continuumsecurity/bdd-security.git, without any typos in the organization name. Using 'github clone' instead of 'git clone' is invalid, as 'github' is not a recognized command-line tool for this operation — the actual Git version control command is 'git'.

Prisma Cloud relies on advanced unsupervised machine learning to automatically build a behavioral baseline of what is 'normal' for each customer's specific cloud network traffic, without needing labeled datasets. Because cloud environments and traffic patterns vary widely between customers, unsupervised learning allows the model to adapt to each unique environment and flag statistically significant deviations as potential threats — including previously unseen (zero-day) attacks — while reducing false positive alerts compared to static, signature-based detection methods.

Sqreen's security automation feature is called a Playbook. To send alerts to Slack, a user creates a playbook in the Sqreen Dashboard (Playbooks > Create a playbook) and configures three elements: a trigger (a condition based on a threshold of events within a timeframe for a specific actor), a security response (the action taken against the bad actor, such as blocking or redirecting the IP), and a notification (settings that determine when and how the team is alerted, such as sending an email and/or a Slack message based on severity and frequency). This workflow — playbook, trigger, security response, notification — is exactly how Sqreen routes security alerts to Slack.

Secure by design incorporates security into the application’s architecture and development decisions. Establishing access control, using proven mechanisms, protecting weak points, applying defense in depth, and limiting third-party involvement are design-level measures that make security an integral property of the application.

The Gradle wrapper executable on Unix-based systems is correctly named "gradlew" and must be run with the "./" prefix (./gradlew) to indicate it should execute from the current working directory; "gradlev" is not a valid file name and "/gradlew" implies an incorrect absolute path. In Cucumber tag expressions used with the -Dcucumber.options flag, the tilde (~) symbol is used to negate a tag, so "~@skip" correctly excludes scenarios tagged @skip while including those tagged @authentication, which is the intended behavior when running only the authentication feature without skipped tests.

The git pull command is used to fetch changes from a remote repository and automatically merge them into the current local branch, effectively combining git fetch followed by git merge in a single operation. This is exactly the behavior needed to retrieve online updates and integrate them with local work. The other options are invalid: git grabs and git get are not real Git commands, and git push does the opposite — it uploads local commits to the remote repository rather than pulling updates down.

Bitbucket provides free unlimited private repositories (along with unlimited public repositories) as part of its free plan for individuals and small teams of up to five users. This is a distinguishing feature of Bitbucket's offering, allowing organizations to keep their source code private without incurring repository count limits, while other resources such as build minutes and storage are capped instead.

The terraform destroy command is the built-in Terraform CLI command used to destroy all remote objects that are managed by a particular Terraform configuration, based on the current state file. It performs the reverse of terraform apply, terminating and removing all the resources (in this case, the resource group and VM) that Terraform tracks. The other listed commands (kill-infra, destroy-infra, kill) are not valid Terraform CLI commands.

The Jenkins Azure Key Vault plugin requires a valid Azure service principal credential stored in Jenkins and selected as the plugin’s Credential ID. A new Azure credential should be added in Jenkins under Global Credentials (unrestricted), using the Azure application credentials, so the plugin can authenticate to the Key Vault.

pytm generates a sequence diagram by piping the output of the --seq flag into PlantUML, which renders the PNG image. The correct invocation requires the Java system property flag to be capitalized as -D (e.g., -Djava.awt.headless=true), since Java only recognizes uppercase -D for defining system properties — a lowercase -d is invalid. It also requires the correctly spelled plantuml.jar file, not a misspelled variant such as plantum.jar. Only the command tm.py --seq | java -Djava.awt.headless=true -jar plantuml.jar -tpng -pipe > seq.png uses both the valid Java flag and the correct PlantUML jar filename, matching the official pytm usage documented in its GitHub repository and OWASP references.

CloudMapper's documentation specifies that, to run its collect command and gather AWS account metadata for security auditing, the IAM identity used must have the AWS managed policies arn:aws:iam::aws:policy/SecurityAudit and arn:aws:iam::aws:policy/job-function/ViewOnlyAccess attached. The SecurityAudit policy grants read-only access to security configuration metadata across AWS services, which is essential for auditing tools, while ViewOnlyAccess grants broad List*, Describe*, Get*, View*, and Lookup* permissions needed to enumerate resources. Together these two managed policies provide the read-only visibility CloudMapper needs without granting any modify permissions.

git-multimail includes a built-in self-check mechanism: when the hook script is invoked with the environment variable GIT_MULTIMAIL_CHECK_SETUP set to a non-empty string, it prints out the resolved configuration values (administrator, charset, email prefix, FQDN, project description, pusher, repository path, and repository short name), verifies that standard input works correctly, and reports whether git-multimail appears to be properly configured (or flags missing required settings, such as no configured email recipients). This behavior is documented in the official git-multimail troubleshooting guide. The variable must be set to a non-empty value — an empty string has no effect — and the correct variable name is GIT_MULTIMAIL_CHECK_SETUP, not GITHUB_MULTIMAIL_CHECK_SETUP.

Azure Kubernetes Service deployments require an Azure resource group to be created first, using the Azure CLI. The correct Azure CLI syntax for creating a resource group is az group create --name <name> --location <location>. The command az group create --name Jenkins --location southindia correctly uses the az CLI, the valid group create subcommand, and the full, valid parameter names --name and --location, matching Microsoft's official documentation for the az group create command and the standard AKS cluster deployment tutorial workflow.

Bandit is a static application security testing (SAST) tool developed and maintained under the Python Code Quality Authority (PyCQA) project. It works by building an abstract syntax tree (AST) from Python source code and running plugins against the AST nodes to identify common security issues such as hardcoded passwords, use of insecure functions, SQL injection risks, and weak cryptographic practices. Bandit is designed exclusively for Python codebases and does not support scanning Ruby, C++, or Java source code, so integrating it with Jenkins only enables detection of security issues in Python code.

Change lead time (for application) is the GSA high-value DevSecOps metric that tracks the elapsed time from when code is committed to when it is deployed into production, following bug fixes and new features as they progress through development, testing, and production stages. This distinguishes it from mean time to recovery (which measures restoration time after an incident), change volume (which measures the amount of change delivered), and time to value (which measures how quickly a delivered change produces business value).

AWS CodePipeline pipelines created from CloudFormation pipeline templates (including those that integrate SAST tools like SonarQube) rely on an Amazon CloudWatch Events rule to detect source changes. This rule monitors the configured repository (e.g., AWS CodeCommit), and when a commit occurs, it emits a CloudWatch event that automatically triggers the pipeline execution, kicking off the build/scan stages (including the SonarQube code analysis) and any configured SNS-based email notifications for status and approvals. This is distinct from AWS Config (compliance rule evaluation events), Security Hub (aggregated security findings), and BinSkim (a specific binary/SAST scanning tool option, not an event source).

Jenkins provides a built-in environment variable, BUILD_ID (equivalent to BUILD_NUMBER), that increments with each build and uniquely identifies it. By appending ${Build_ID} to a file name in the Post-build Actions tab, Alex ensures that the ZAP scan report or artifact generated for each build is saved with a unique name, preventing overwriting and allowing traceability of results back to a specific build. The other variables referenced—ZAPROXY_HOME (the ZAP installation directory), zap_scan, and Profile_ID—are not Jenkins build identifiers and do not serve this uniquification purpose.

On Linux hosts, Jenkins is typically run as a system service, and its startup environment variables are defined in /etc/sysconfig/jenkins (on RHEL/CentOS-based systems). To let the AWS Secrets Manager Credentials Provider plugin authenticate to AWS, the AWS access key ID, secret access key, and region must be exported as environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION) in this file so they are available to the Jenkins process at startup, since the plugin relies on the standard AWS SDK credentials/region resolution chain.

Retire.js is an open-source Software Composition Analysis (SCA) tool built specifically to scan JavaScript and Node.js applications for known, publicly disclosed vulnerabilities in their third-party libraries and dependencies. It checks the libraries used in a project against a database of known vulnerabilities and flags any insecure or outdated components. In contrast, Bundler-Audit is used for auditing Ruby Gemfile.lock dependencies, Bandit is a static application security testing (SAST) tool for Python source code, and Tenable.io is a broader vulnerability management platform focused on network and infrastructure scanning rather than JavaScript dependency analysis.

When configuring a Jenkins build step to run a Burp Suite scan via the Burp Suite Jenkins plugin, the target URL is defined by echoing the BURP_SCAN_URL environment variable within the Execute shell field, e.g., 'echo BURP_SCAN_URL = http://target-website.com'. This sets/outputs the scan target so the plugin can pick it up and initiate the scan against the specified web application during the Jenkins build process. The other commands are unrelated to defining this variable: 'sudo' elevates privileges for command execution, 'grep' searches for text patterns, and 'cat' displays file contents — none of these are used to assign or declare the scan URL variable in this context.

GitLab CI/CD pipelines are driven by a configuration file that must be named exactly '.gitlab-ci.yml' and placed in the root directory of the repository. GitLab's CI/CD runner automatically looks for this file to define pipeline jobs and stages. To integrate the Checkmarx SCA template (which defines all the security scanning jobs), Dustin needs to add or include its contents within the '.gitlab-ci.yml' file at the root of his GitLab project, either by copying the template content directly or using GitLab's 'include' keyword to reference the external template.