Eccouncil 312-97 Exam Questions

In a mature DevSecOps pipeline, security controls are enforced as gates, not merely as informational checks. When an SCA tool detects a critical vulnerability in a dependency---whether direct or transitive---the correct response at the Build and Test stage is to fail the build. This prevents vulnerable artifacts from moving forward into later stages such as deployment or production, where remediation would be more expensive and risky. Allowing the build to continue, even with notifications, contradicts the shift-left security principle. Ignoring transitive dependencies is also dangerous, as many real-world vulnerabilities originate from indirect libraries. Failing the build forces developers to remediate the issue immediately by upgrading, replacing, or mitigating the vulnerable dependency. This approach reduces attack surface, enforces accountability, and ensures that only secure artifacts are released. Therefore, stopping the pipeline upon detection of critical vulnerabilities reflects a strong DevSecOps maturity model and effective security governance.

Git post-commit hooks are executed automatically after a commit is successfully created. To trigger the Jenkins build job configured to respond to commits, Alex must create a valid Git commit using the correct Git command. The standard command to commit changes with a message is git commit -m 'commit from terminal'. Running this command records the changes in the repository and triggers the post-commit hook, which in turn initiates the Jenkins build. Commands using github commit are invalid because github is not a native Git command-line utility. The -b flag is also not used with git commit. Automating build triggers during the Code stage improves efficiency, reduces manual intervention, and ensures continuous integration is consistently enforced.

Jira uses Atlassian Query Language, commonly referred to as JQL, to search, filter, and manage issues. This query language allows users to create advanced searches using fields such as project, status, assignee, priority, and custom attributes. Although often informally called Jira Query Language, the official name among the given options is Atlassian Query Language. SQL and Java query language are unrelated and not used for issue searching in Jira. Using JQL during the Code stage improves traceability between source code commits, builds, and tracked issues, enabling teams to monitor progress, validate deployment status, and maintain alignment between development and delivery activities.

When working inside an interactive Docker container session, the container continues running as long as its primary foreground process is active. Executing the exit command terminates the shell session, which in turn stops the container if no other foreground processes are running. The kill command requires a process identifier and is not used in this context, while clear simply clears the terminal screen and does not affect container execution. The stop command is not a valid shell command inside a container. Properly stopping containers during the Operate and Monitor stage helps free system resources, prevent unintended service exposure, and maintain a clean runtime environment. This practice aligns with container lifecycle management best practices and reduces operational risk.

The BDD Security framework is executed through Gradle wrapper commands, and the correct wrapper script on Unix-like systems is ./gradlew (dot-slash indicates ''run the wrapper from the current directory''). Options using /gradlew or /gradlev imply an absolute path at filesystem root and are typically incorrect for a cloned project. Also, the wrapper name is gradlew, not gradlev. For executing only the authentication feature (or scenarios tagged for authentication), Cucumber tag expressions are used through the -Dcucumber.options system property. The command must include --tags @authentication to select authentication-tagged scenarios. To skip scenarios tagged ''skip,'' the exclusion operator is used as --tags ~@skip (meaning ''exclude @skip''). Options A and B incorrectly include --tags @skip which would include skipped tests rather than exclude them. Therefore, ./gradlew -Dcucumber.options='--tags @authentication --tags ~@skip' is the correct choice to run authentication scenarios while excluding anything marked to skip.