Eccouncil 312-97 Exam Questions

When working inside an interactive Docker container session, the container continues running as long as its primary foreground process is active. Executing the exit command terminates the shell session, which in turn stops the container if no other foreground processes are running. The kill command requires a process identifier and is not used in this context, while clear simply clears the terminal screen and does not affect container execution. The stop command is not a valid shell command inside a container. Properly stopping containers during the Operate and Monitor stage helps free system resources, prevent unintended service exposure, and maintain a clean runtime environment. This practice aligns with container lifecycle management best practices and reduces operational risk.

The BDD Security framework is executed through Gradle wrapper commands, and the correct wrapper script on Unix-like systems is ./gradlew (dot-slash indicates ''run the wrapper from the current directory''). Options using /gradlew or /gradlev imply an absolute path at filesystem root and are typically incorrect for a cloned project. Also, the wrapper name is gradlew, not gradlev. For executing only the authentication feature (or scenarios tagged for authentication), Cucumber tag expressions are used through the -Dcucumber.options system property. The command must include --tags @authentication to select authentication-tagged scenarios. To skip scenarios tagged ''skip,'' the exclusion operator is used as --tags ~@skip (meaning ''exclude @skip''). Options A and B incorrectly include --tags @skip which would include skipped tests rather than exclude them. Therefore, ./gradlew -Dcucumber.options='--tags @authentication --tags ~@skip' is the correct choice to run authentication scenarios while excluding anything marked to skip.

HashiCorp Vault provides a key-value (KV) secrets engine for securely storing sensitive data. To remove a secret from the KV store, the correct command is vault kv del . This command deletes the secret data at the specified path. Options using -delete or -del are syntactically incorrect, and vault kv delete is not a valid Vault CLI command. Proper secret deletion is an essential part of secret lifecycle management, especially when credentials may have been compromised. Performing this action during the Operate and Monitor stage helps contain security incidents, reduce exposure, and ensure that compromised secrets are no longer accessible. Timely deletion of secrets supports effective incident response and strengthens overall security posture.

w3af (Web Application Attack and Audit Framework) is a Dynamic Application Security Testing (DAST) tool. It analyzes running web applications by sending crafted requests and observing responses to identify vulnerabilities such as SQL injection, cross-site scripting, and authentication flaws. Unlike SAST tools, w3af does not require access to source code and instead operates externally, simulating real-world attack behavior. SCA focuses on third-party dependencies, and IAST requires runtime instrumentation within the application. Since Debra detected vulnerabilities by actively interacting with the application, w3af clearly represents DAST. DAST tools are especially valuable during the Build and Test stage, as they validate application behavior from an attacker's perspective before deployment.

On Debian- and Ubuntu-based systems, ModSecurity for Apache is installed using the package libapache2-mod-security2. The correct command to install this package is sudo apt install libapache2-mod-security2 -y, where the -y flag automatically confirms installation prompts. The other options include invalid flags that are not recognized by the package manager and would result in command failure. Installing ModSecurity during the Operate and Monitor stage provides an additional layer of defense by inspecting incoming HTTP requests and blocking malicious traffic such as SQL injection, cross-site scripting, and protocol violations. A Web Application Firewall helps protect deployed applications from common attack vectors and supports defense-in-depth strategies in production environments.