[Full-Version] 2026 New Preparation Guide of ECCouncil 312-97 Exam [Q90-Q106]

NO.90 John is a DevSecOps Engineer working at a software company that is implementing security early in its DevOps workflow, also known as "shifting security left." The Chief Technology Officer (CTO) and Chief Information Officer (CIO) are particularly interested in improving developer productivity while ensuring security is integrated into the development lifecycle from the start. To which category of DevSecOps stakeholders do the CTO and CIO belong?

NO.91 A healthcare organization recently suffered a security breach due to an exposed SSH key in one of its public Git repositories. To prevent similar incidents, the DevSecOps team decides to enforce a security mechanism that blocks sensitive information such as private keys and authorization tokens from being committed at the source. What is the best approach to achieve this?

NO.92 BVR Pvt. Ltd. is an IT company that develops software products and applications related to IoT devices. The software development team of the organization is using Bitbucket repository to plan projects, collaborate on code, test, and deploy. The repository provides teams a single place for projects planning and collaboration on coding, testing, and deploying the software application.
Which of the following is offered by Bitbucket to BVR Pvt. Ltd.?

NO.93 John, a software developer, wants to monitor the status of a running Kubernetes service without navigating through multiple dashboards. Instead, he interacts with Kubiya using a simple command to retrieve service logs and performance metrics, ensuring that the application is running smoothly and identifying potential issues. This interaction is focused on observability, monitoring, and system performance tracking, which are key aspects of maintaining and managing deployed applications. Which CI/CD pipeline phase does this interaction fall under?

NO.94 SNF Pvt. Ltd. is a software development company located in Denver, Colorado. The organization is using pytm, which is a Pythonic Framework for threat modeling, to detect security issues and mitigate them in advance. James Harden has been working as a DevSecOps engineer at SNF Pvt. Ltd. for the past 3 years. He has created a tm.py file that describes an application in which the user logs the app and posts the comments on the applications. These comments are stored by the application server in the database and AWS lambda cleans the database. Which of the following command James can use to generate a sequence diagram?

NO.95 Isabela Marques, a DevSecOps engineer at a Porto software consultancy, wants developers to receive immediate feedback about newly introduced vulnerabilities directly within their pull request, before a reviewer even looks at the code, rather than waiting for a separate nightly scan report. What practice best achieves this?

NO.96 (Charles Drew has been working as a DevSecOps team leader in an IT company located in Nashville, Tennessee. He would like to look at the applications from an attacker’s perspective and make security a part of the organizations’ culture. Imagine, you are working under Charles as a DevSecOps engineer. Charles has asked you to install ThreatPlaybook, which is a unified DevSecOps Framework that allows you to go from iterative, collaborative threat modeling to application security testing orchestration. After installation, you must configure ThreatPlaybook CLI; therefore, you have created a directory for the project and then you go to the current directory where you would like to configure ThreatPlaybook. Which of the following commands will you use to configure ThreatPlaybook? (Here, < your-email > represents your email id; < host info > represents IP address; and < port > represents the nginx port.))

NO.97 Brett Ryan has been working as a senior DevSecOps engineer in a multinational company that develops web applications. The team leader of the software development team requested Brett to detect insecure JavaScript libraries in the web application code. Brett would like to perform the vulnerability scanning on web application with grunt-retire. Which of the following commands would enable grunt plugin?

NO.98 Camila Duarte, a DevSecOps engineer at a Sao Paulo media company, is setting up her Jenkins pipeline to store database credentials, API keys, and TLS certificates outside of source code and configuration files, with automatic rotation and fine-grained access policies. Which type of tool should she integrate?

NO.99 Andrew Gerrard has recently joined an IT company that develops software products and applications as a DevSecOps engineer. His team leader asked him to download a jar application from the organization GitHub repository and run the BDD security framework. Andrew successfully downloaded the jar application from the repository and executed the jar application; then, he cloned the BDD security framework. Which of the following commands should Andrew use to execute the authentication feature?

NO.100 Kenneth Danziger is a certified DevSecOps engineer, and he recently got a job in an IT company that develops software products related to the healthcare industry. To identify security and compliance issues in the source code and quickly fix them before they impact the source code, Kenneth would like to integrate WhiteSource SCA tool with AWS. Therefore, to integrate WhiteSource SCA Tool in AWS CodeBuild for initiating scanning in the code repository, he built a buildspec.yml file to the source code root directory and added the following command to pre-build phase curl -LJO https://github.com/whitesource/unified-agent- distribution/raw/master/standAlone/wss_agent.sh. Which of the following script files will the above step download in Kenneth organization’s CodeBuild server?

NO.101 (William Scott, after completing his graduation in computer science, joined an IT company as a DevSecOps engineer. His team leader has asked him to use GitHub Code Scanning for evaluating the source code in his organization’s GitHub repository to detect security issues and coding errors. How can William set up coding scanning in GitHub repository?)

NO.102 (Rachel Maddow has been working at RuizSoft Solution Pvt. Ltd. for the past 7 years as a senior DevSecOps engineer. To develop software products quickly and securely, her organization has been using AWS DevOps services. On January 1, 2022, the software development team of her organization developed a spring boot application with microservices and deployed it in AWS EC2 instance. Which of the following AWS services should Rachel use to scan the AWS workloads in EC2 instance for security issues and unintended network exposures?.)

NO.103 William Scott has been working as a senior DevSecOps engineer at GlobalSec Pvt. Ltd. His organization develops software products related to mobile apps. William would like to exploit Jenkins using Metasploit framework; therefore, he downloaded Metasploit. He would like to initiate an Nmap scan by specifying the target IP to find the version of Jenkins running on the machine. Which of the following commands should William use to find the version of Jenkins running on his machine using Nmap?

NO.104 David Reynolds, a DevSecOps engineer at MedSecure Technologies, is responsible for ensuring the security of web applications and APIs developed for the healthcare industry. Given the sensitive nature of healthcare data, his team requires a runtime security testing approach that provides deep visibility into application vulnerabilities while minimizing false positives. To achieve this, David integrates an IAST (Interactive Application Security Testing) solution that uses a web scanner combined with an agent inside the application server, identifies vulnerabilities in real-time while the application is running, and pinpoints the exact location of security flaws in the source code for faster remediation. Which type of IAST solution is David using?

NO.105 (Brett Ryan has been working as a senior DevSecOps engineer in a multinational company that develops web applications. The team leader of the software development team requested Brett to detect insecure JavaScript libraries in the web application code. Brett would like to perform the vulnerability scanning on web application with grunt-retire. Which of the following commands would enable grunt plugin?)

NO.106 During a software development sprint, Maria, a DevSecOps team lead, is responsible for implementing a security strategy to identify vulnerabilities in the software lifecycle. After assessing her team’s workflow, she realizes during development, they need a security approach that can identify logic errors and data flow issues early, before the application is deployed. During production, they require a real-time security mechanism to detect runtime threats and prevent active attacks without disrupting normal application functionality. Which combination of security testing methods should Maria recommend to meet both requirements effectively?