Study with ECCouncil : 312-97 Exam Torrent as your best preparation materials

A healthcare organization recently suffered a security breach due to an exposed SSH key in one of its public Git repositories. To prevent similar incidents, the DevSecOps team decides to enforce a security mechanism that blocks sensitive information such as private keys and authorization tokens from being committed at the source. What is the best approach to achieve this?

• A. Using a repository hook before each commit or push.
• B. Encrypting all commits before pushing them to the repository.
• C. Reviewing the Git bash command output to detect leaks after the commit.
• D. Relying on endpoint security software to detect leaks after the commit.

Fatima Zahra Bennani, a DevSecOps engineer at a Casablanca telecom, needs to verify that a specific compliance control - encryption at rest for all cloud storage buckets - is continuously enforced across the entire AWS environment, not just checked once during initial setup. Which type of tool should Fatima adopt?

• A. Git commit hook
• B. One-time manual audit spreadsheet
• C. Static code analyzer for application source
• D. Cloud Security Posture Management (CSPM) tool

Lisa is a security engineer working in a DevOps team that follows a traditional security approach, where security testing occurs only at the end of the software development lifecycle. She notices that this approach leads to production delays due to extensive security rework. To resolve this, Lisa suggests integrating security into each phase of the development pipeline, ensuring vulnerabilities are identified and mitigated early. Which approach is Lisa advocating?

• A. Continuous Security Integration.
• B. Risk-Based Security Enhancement.
• C. Shifting Security to the Left.
• D. Security Operations Management.

Michael Johnson, a DevSecOps lead at a software development company, wants to ensure that security policies remain intact during the software deployment phase. His team has observed that manual security checks are prone to errors and inefficiencies, leading to misconfigurations and policy deviations. To address this, they seek an AI-powered solution that can manage security configurations, detect policy violations, and automate security testing within the development environment, ensuring a secure and compliant deployment process. Which of the following AI-powered technologies should Michael implement?

• A. AI-powered DAST for runtime vulnerability scanning.
• B. AI-powered Runtime Application Self-Protection (RASP).
• C. AI-Powered Vulnerability Management tool.
• D. AI-powered SAST for source code security.

Sophia, a DevSecOps engineer, is working on improving the security posture of her organization's cloud-native applications. She wants to integrate continuous threat modeling directly into the software development process to ensure that developers can identify security risks while writing code. To achieve this, she introduces a tool that allows developers to annotate source code with security concerns, generate data flow diagrams (DFDs), and create threat model reports dynamically. This approach enables real-time visibility into security risks and bridges the gap between development and security teams. Which tool should Sophia use to achieve this?

• A. ThreatSpec.
• B. Threagile.
• C. Bandit.
• D. JIRA.