312-97: EC-Council Certified DevSecOps Engineer (ECDE)Demo

By ECCouncil · Question Mode

QuestionQ1

DevSecOps Pipeline-Build and Test Stage

Craig Kelly has spent the last 8 years working as a software development team leader at an IT company, where his team is currently building an Android application. Sandra Oliver, a DevSecOps engineer, used DAST tools and fuzz testing to conduct advanced checks on this Android application and identified critical and high severity issues. She then shared details of these security issues, along with mitigation recommendations, with Craig's team.

Which category of security checks performed by Sandra is characterized by the use of DAST tools and fuzz testing to identify critical and high severity issues?

  • A Deploy-time checks
  • B Commit-time checks
  • C Test-time checks
  • D Build-time checks
Explanation

Test-time checks occur during the testing phase of the software development lifecycle and involve dynamically exercising a running instance of the application to uncover vulnerabilities that static analysis cannot detect. DAST (Dynamic Application Security Testing) tools interact with the running application to find exploitable flaws, while fuzz testing supplies unexpected or malformed inputs to reveal crashes, memory issues, and other high-severity vulnerabilities. These techniques are applied at the test-time stage of the DevSecOps pipeline, distinguishing them from commit-time checks (e.g., SAST/secret scanning on code commits), build-time checks (e.g., software composition analysis during builds), and deploy-time checks (e.g., configuration and infrastructure validation prior to deployment).

Community Discussion

No comments yet. Be the first to start the discussion!