ECCouncil 312-97 考試大綱：

主題	簡介
主題 1	DevSecOps Pipeline - Plan Stage: This module covers the planning phase, emphasizing security requirement identification and threat modeling. It highlights cross-functional collaboration between development, security, and operations teams to ensure alignment with security goals.
主題 2	DevSecOps Pipeline - Operate and Monitor Stage: This module focuses on securing operational environments and implementing continuous monitoring for security incidents. It covers logging, monitoring, incident response, and SIEM tools for maintaining security visibility and threat identification.
主題 3	Introduction to DevSecOps: This module covers foundational DevSecOps concepts, focusing on integrating security into the DevOps lifecycle through automated, collaborative approaches. It introduces key components, tools, and practices while discussing adoption benefits, implementation challenges, and strategies for establishing a security-first culture.
主題 4	DevSecOps Pipeline - Release and Deploy Stage: This module explains maintaining security during release and deployment through secure techniques and infrastructure as code security. It covers container security tools, release management, and secure configuration practices for production transitions.
主題 5	DevSecOps Pipeline - Build and Test Stage: This module explores integrating automated security testing into build and testing processes through CI pipelines. It covers SAST and DAST approaches to identify and address vulnerabilities early in development.
主題 6	DevSecOps Pipeline - Code Stage: This module discusses secure coding practices and security integration within the development process and IDE. Developers learn to write secure code using static code analysis tools and industry-standard secure coding guidelines.

參考：https://www.eccouncil.org/train-certify/certified-devsecops-engineer-ecde/

ECCouncil 312-97 考試概覽:

認證廠商:	EC-Council
考試名稱:	EC-Council 認證 DevSecOps 工程師（ECDE）
考試代碼:	312-97
證照有效期限:	3 年
及格分數:	70%
實際考試題數:	100
考試費用:	250 美元
相關認證:	CEH（認證道德駭客） CSA（安全應用程式開發師認證） CND（網路防禦師認證）
支援語言:	英文
考試形式:	選擇題, 情境式試題
考試時間:	180 分鐘
範例考題:	ECCouncil 312-97 範例考題
考試方式:	線上遠端監考或於授權考試中心應考
必備條件:	建議具備至少 2 年資安或軟體開發相關經驗；CEH 認證為建議的先備資格
官方大綱網址:	https://www.eccouncil.org/Certification/item/exam-312-97-ec-certified-devsecops-engineer-ecde

最新的 Certified DevSecOps Engineer 312-97 免費考試真題：

問題 #1

Steven Gerrard has been working as a DevSecOps engineer at an IT company that develops software products and applications related to the healthcare industry. His organization has been using Azure DevOps services to securely and quickly develop software products. To ensure that the deployed infrastructure is in accordance with the architecture and industrial standards and the security policies are appropriately implemented, she would like to integrate InSpec with Azure.
Therefore, after installation and configuration of InSpec, she created InSpec profile file and upgraded it with personal metadata and Azure resource pack information; then she wrote the InSpec tests. Which of the following commands should Steven use to run InSpec tests to check the compliance of Azure infrastructure?

A. inspec exec inspec-tests/integration/ -it azure://.
B. inspec exec inspec-tests/integration/ -t azure://.
C. inspec exe inspec-tests/integration/ -t azure://.
D. inspec exe inspec-tests/integration/ -it azure://.

顯示解答討論 0

答案：B 🗳️

說明：（僅 VCESoft 成員可見）

問題 #2

Matt LeBlanc has been working as a DevSecOps engineer in an IT company that develops software products and web applications for IoT devices. His team leader has asked him to use GitRob tool to find sensitive data in the organizational public GitHub repository. To install GitRob, Matt ensured that he has correctly configured Go >= 1.8 environment and that $GOPATH/bin is in his $PATH. The GitHub repository URL from which he is supposed to install the tool is
https://github.com/michenriksen/gitrob. Which of the following command should Matt use to install GitRob?

A. $ go git github.com/michenriksen/gitrob.
B. $ go git gitrob github.com/michenriksen/gitrob.
C. $ go get github.com/michenriksen/gitrob.
D. $ go get gitrob github.com/michenriksen/gitrob.

顯示解答討論 0

答案：C 🗳️

說明：（僅 VCESoft 成員可見）

問題 #3

Bruno Nascimento, a DevSecOps engineer at a Sao Paulo bank, wants to ensure that microservices communicating within his Kubernetes cluster mutually authenticate each other and encrypt all traffic between them, without modifying application code. Which technology should Bruno deploy?

A. WAF at the ingress
B. Service mesh with mutual TLS (e.g., Istio)
C. VPN between developer laptops
D. Static application firewall rules

顯示解答討論 0

答案：B 🗳️

說明：（僅 VCESoft 成員可見）

問題 #4

Cindy Williams recently joined TechSecure Inc. as a DevSecOps engineer. She was assigned the task of improving the security of the company's Ruby-based applications within the CI/CD pipeline. To achieve this, she configured Bundler-Audit in Travis CI to scan for vulnerabilities in gem dependencies. After running the audit, Cindy discovered that some gems in the Gemfile.lock were outdated and contained security vulnerabilities. She quickly applied the necessary updates and ensured that the application used secure versions of the dependencies. Which method does Bundler-Audit use to identify security vulnerabilities in gem dependencies?

A. It runs the application and monitors for insecure function calls in real-time.
B. It checks the official RubyGems repository for version mismatches.
C. It performs a static analysis of the gem source code to detect vulnerabilities.
D. It cross-references the gem versions with a known security advisory database.

顯示解答討論 0

答案：D 🗳️

說明：（僅 VCESoft 成員可見）

問題 #5

Attackers exploited a vulnerability in a healthcare organization's application, injected malicious commands into user input fields, gained unauthorized access to the underlying server, exfiltrated patient records, and tampered with critical files. In this case, which of the following tools can assist the DevSecOps engineer of the organization in flagging the injection vulnerability in the codebase and provide actionable recommendations to fix the issue in their Azure DevOps pipeline?