312-97: EC-Council Certified DevSecOps Engineer (ECDE)Demo

By ECCouncil · Question Mode

QuestionQ20

DevSecOps Pipeline-Code Stage

Alexander Hamilton, a senior DevSecOps engineer at a company in Greenville, South Carolina, works for an organization that suffered a costly cybersecurity attack in January 2012. In response, the organization quickly adopted AWS cloud-based services to build software securely and efficiently.

To detect security issues during code review, Alexander wants to integrate SonarQube with AWS CodePipeline. He therefore:

  • Created a pipeline in AWS using a CloudFormation pipeline template
  • Selected the SonarQube tool from the tools dropdown
  • Provided the required stack parameters
  • Provided an email address to receive notifications about pipeline status changes and approvals
  • Deployed the pipeline after entering all the required information

What will happen when changes are committed to the application repository?

  • A Cloud Config event is created
  • B CloudWatch event is created
  • C Security Hub event is created
  • D BinSkim event is created
Explanation

AWS CodePipeline pipelines created from CloudFormation pipeline templates (including those that integrate SAST tools like SonarQube) rely on an Amazon CloudWatch Events rule to detect source changes. This rule monitors the configured repository (e.g., AWS CodeCommit), and when a commit occurs, it emits a CloudWatch event that automatically triggers the pipeline execution, kicking off the build/scan stages (including the SonarQube code analysis) and any configured SNS-based email notifications for status and approvals. This is distinct from AWS Config (compliance rule evaluation events), Security Hub (aggregated security findings), and BinSkim (a specific binary/SAST scanning tool option, not an event source).

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!