EC-Council · ECDE
Certified DevSecOps Engineer (ECDE) Practice Test
Validates the ability to integrate security practices into DevOps pipelines and continuous delivery workflows, covering DevSecOps culture, threat modeling, secure code review, automated security testing, container security, and security monitoring throughout the software development lifecycle.
Exam Details
Questions
609
Duration
240 minutes
Passing Score
70%
Difficulty
AssociateLast Updated
Feb 2026
Certified DevSecOps Engineer (ECDE) Practice Exam Preparation
Use this ECDE practice exam to prepare for Certified DevSecOps Engineer (ECDE) with realistic questions, detailed explanations, and focused study modes. The practice bank includes 609 questions for EC-Council ECDE, so you can review the exam steadily instead of relying on one long cram session.
As you practice, pay extra attention to patterns in your missed answers. Start with short sessions to identify weak areas, then move into timed quizzes once your accuracy is consistent.
The explanations are especially useful when you want to connect exam wording to the responsibilities and scenarios described in the official certification guidance. Use the free preview first, then unlock the full question bank when you are ready to build a complete study routine.
Exam Overview
The EC-Council Certified DevSecOps Engineer (E|CDE), exam code 312-97, is a comprehensive certification that validates a professional's ability to embed security practices across the entire DevOps pipeline. The program covers all eight stages of the DevOps lifecycle — from planning and coding through building, testing, releasing, deploying, operating, and monitoring — ensuring that security is treated as a shared, continuous responsibility rather than an afterthought. Candidates learn to apply threat modeling, secure coding guidelines, static and dynamic application security testing (SAST/DAST), infrastructure as code (IaC) security, container security, and runtime monitoring using industry tools such as SonarQube, Snyk, Checkmarx, Jenkins, Terraform, and Docker Bench.
The certification is notably hands-on, featuring over 80 guided lab exercises delivered in virtual environments spanning Amazon Web Services (AWS), Microsoft Azure, and on-premises platforms. This dual focus on theoretical DevSecOps principles and practical tool-based implementation distinguishes E|CDE from more conceptual security credentials, making it one of the most lab-intensive DevSecOps certifications available. The program has been updated to incorporate AI-powered security tooling and cloud-native security patterns relevant to modern CI/CD workflows.
Who Should Take This Exam
The E|CDE is designed for mid-career technology professionals who work at the intersection of software development, operations, and security. Primary target roles include DevOps engineers looking to formalize their security knowledge, application security specialists transitioning into DevSecOps, software engineers and QA testers responsible for secure delivery pipelines, and cybersecurity engineers or analysts who need to integrate security tooling into CI/CD workflows. Professionals holding EC-Council's Certified Application Security Engineer (CASE) credential or similar AppSec certifications will find E|CDE a natural progression.
EC-Council recommends candidates have at least two years of experience in information security, along with familiarity with SDLC concepts, automation tools, and scripting languages such as Python or PowerShell. The certification suits professionals targeting specialized roles such as DevSecOps Engineer, Cloud DevSecOps Engineer, AWS/Azure DevSecOps Engineer, or CI/CD Security Engineer.
Prerequisites
EC-Council requires applicants who wish to sit for the exam without attending official training to have a minimum of two years of work experience in the information security domain and to submit an eligibility application with a non-refundable fee of USD $100. Candidates who complete an authorized EC-Council training course have the application fee included and gain direct exam eligibility upon course completion.
While there are no mandatory prerequisite certifications, candidates are strongly advised to arrive with a working understanding of application security concepts, the Software Development Lifecycle (SDLC), and CI/CD pipeline fundamentals. Familiarity with at least one cloud platform (AWS or Azure), containerization concepts (Docker, Kubernetes), and basic scripting will allow candidates to make full use of the lab-heavy curriculum and perform well on exam questions focused on practical tool configuration and pipeline integration.
Exam Format
The E|CDE exam (code 312-97) consists of 100 multiple-choice questions and must be completed within 240 minutes (4 hours). The exam is closed-book and is delivered exclusively through the ECC Exam Centre portal; it is not available at third-party proctoring sites. A passing score of 70% (70 out of 100 correct) is required. The exam fee is USD $550, and the voucher is valid for one year from the date of receipt.
There are no published unscored or survey questions. Upon passing, certified professionals are enrolled in EC-Council's Continuing Education Scheme and must pay an annual maintenance fee of USD $80 to keep the credential active.
Skills Measured
- 1.Domain 1 – Understanding DevOps Culture: Foundational DevOps principles, collaboration models between development and operations teams, CI/CD concepts, automation philosophies, and continuous improvement through feedback loops.
- 2.Domain 2 – Introduction to DevSecOps: Integrating security into DevOps lifecycles, shifting left on security, DevSecOps culture and organizational adoption, security automation fundamentals, monitoring, and key toolchain considerations.
- 3.Domain 3 – DevSecOps Pipeline: Plan Stage: Security requirements gathering, threat modeling methodologies and tools (Threat Dragon, ThreatModeler, Threatspec), risk assessment during project planning, and alignment of security objectives with business goals.
- 4.Domain 4 – DevSecOps Pipeline: Code Stage: Secure coding practices, static application security testing (SAST) integration in IDEs and repositories, secret detection, dependency scanning, and tools such as SonarQube, Snyk, and Checkmarx.
- 5.Domain 5 – DevSecOps Pipeline: Build and Test Stage: Automated security testing within CI pipelines (SAST, DAST, IAST), security policy as code (SPACK), integration with build tools such as Jenkins, Bamboo, TeamCity, and Gradle, and software composition analysis.
- 6.Domain 6 – DevSecOps Pipeline: Release and Deploy Stage: Infrastructure as Code (IaC) security with Terraform and CloudFormation, container security hardening (Docker Bench), secure deployment strategies, runtime application self-protection (RASP), and configuration management.
- 7.Domain 7 – DevSecOps Pipeline: Operate and Monitor Stage: Continuous security monitoring, SIEM tool implementation, logging strategies, incident detection and response, cloud-native monitoring on AWS and Azure, and feedback loops for security improvement.
Study Tips
- Use the official EC-Council courseware as your primary study resource — the seven modules map directly to the seven exam domains, and the lab scenarios are closely aligned with practical exam questions on tool configuration and pipeline integration.
- Complete as many of the 80+ hands-on labs as possible, especially the 32 AWS labs and 29 Azure labs, since a significant portion of exam questions tests applied knowledge of cloud-native DevSecOps tool deployment rather than purely conceptual understanding.
- Build a personal reference sheet for each pipeline stage (Plan, Code, Build/Test, Release/Deploy, Operate/Monitor) listing the key tools, their purpose, and when to use them — for example, Threat Dragon for threat modeling, Snyk/SonarQube for SAST, StackHawk for DAST, and Docker Bench for container hardening.
- Study the EDUSUM 312-97 syllabus breakdown and practice with sample questions from EDUSUM's free question bank to get familiar with EC-Council's MCQ phrasing style and identify knowledge gaps in specific domains before exam day.
- Review EC-Council's DevSecOps-focused blog posts and whitepapers on the Cybersecurity Exchange (eccouncil.org/cybersecurity-exchange/devsecops/) to reinforce understanding of the 'shift-left' philosophy, DevSecOps cultural adoption challenges, and AI-integrated security tooling covered in the updated curriculum.
- Focus exam preparation time proportionally on the five pipeline-stage domains (Domains 3–7) rather than the introductory domains, as practical pipeline security decisions and tool configurations represent the majority of exam items.
- If self-studying without official training, ensure you meet the two-year information security experience requirement and submit the eligibility application with the USD $100 fee well in advance of your target exam date, as processing takes time.
Career Benefits
Holding the E|CDE credential positions professionals for high-demand roles in the DevSecOps specialty, which sits at the convergence of software engineering, cloud operations, and cybersecurity — a skills combination that remains scarce in the market. Certified professionals typically pursue titles such as DevSecOps Engineer, Cloud DevSecOps Engineer (AWS or Azure-focused), Infrastructure DevSecOps Engineer, or DevSecOps CI/CD Specialist. According to EC-Council's published data, the average annual salary for a DevSecOps engineer in the United States is approximately USD $139,479, with entry-level positions starting around USD $118,733 and experienced practitioners earning upward of USD $172,500.
Compared to broader security credentials such as CompTIA Security+ or even CEH, E|CDE is deliberately narrow and applied, making it a strong differentiator for professionals who want to demonstrate pipeline-specific security engineering skills to employers adopting DevSecOps practices. The certification's hands-on lab focus on both AWS and Azure cloud environments also complements cloud platform certifications and makes the credential appealing to organizations undergoing cloud-native transformation. Annual continuing education requirements ensure the credential stays current as the tooling landscape evolves.
Sample Questions
5 sample questions with answers and explanations. Start a practice session to test yourself across all 609 questions.
Preview — answers shown1. A DevSecOps team implements continuous security scanning for a Node.js application using npm dependencies. The CI/CD pipeline must detect vulnerabilities in direct and transitive dependencies, generate a Software Bill of Materials in CycloneDX format, and fail builds when high-severity CVEs are detected. Which tool integration should be prioritized? (Select one!)
AConfigure npm audit with --audit-level=high flag to check package-lock.json
BUse OWASP Dependency-Check with Maven plugin and HTML report generation
CIntegrate Snyk with snyk test command for dependency scanning and snyk monitor for continuous monitoring
DImplement Trivy filesystem scanning with --severity HIGH,CRITICAL filter
Explanation
Snyk is purpose-built for Node.js dependency scanning, detecting vulnerabilities in both direct and transitive dependencies through analysis of package.json and package-lock.json. The snyk test command fails builds based on severity thresholds, while snyk monitor sends dependency snapshots for continuous monitoring and alerts on new vulnerabilities. Snyk natively generates CycloneDX SBOMs. npm audit is built into npm but has limited reporting capabilities and does not generate CycloneDX SBOMs. Trivy filesystem scanning can detect some dependency vulnerabilities but is primarily designed for container image scanning. OWASP Dependency-Check with Maven plugin is designed for Java projects, not Node.js npm ecosystems.
2. A DevOps team migrates from Jenkins to AWS and needs to implement a complete CI/CD pipeline with integrated security scanning. The pipeline must support automated builds, security testing, artifact storage, and blue-green deployments. Which AWS service combination correctly implements this pipeline architecture? (Select one!)
AAWS CodePipeline for orchestration, CodeBuild for compilation and security scanning, S3 for artifact storage, CodeDeploy for blue-green deployments
BAWS CodePipeline for orchestration, CodeBuild for compilation and security scanning, Artifact Registry for storage, CodeDeploy for blue-green deployments
CAWS CodeBuild for pipeline orchestration, CodePipeline for builds, DynamoDB for artifact metadata, CodeDeploy for deployment
DAWS CodeCommit for version control, Lambda for build automation, ECR for container storage, ECS for blue-green deployments
Explanation
AWS CodePipeline provides native CI/CD orchestration connecting all pipeline stages. CodeBuild handles compilation, testing, and can integrate security scanning tools like SAST and SCA. S3 serves as the artifact repository for CodePipeline, storing build outputs between stages. CodeDeploy specifically supports blue-green deployment strategies for EC2, Lambda, and ECS. Artifact Registry is a GCP service, not AWS. While Lambda can perform builds, CodeBuild is the purpose-built AWS service for CI/CD build automation. ECR stores container images but isn't the general artifact storage for CodePipeline. CodeBuild cannot orchestrate multi-stage pipelines. DynamoDB is a database, not an artifact storage service for CI/CD pipelines.
3. A DevOps team implements GitLab CI/CD security scanning using built-in templates. The pipeline must include SAST, dependency scanning, secret detection, and container scanning for a Node.js application deployed as a Docker container. Which GitLab CI configuration includes all required security templates? (Select one!)
Ainclude:
- template: Security/SAST.gitlab-ci.yml
- template: Security/DAST.gitlab-ci.yml
Binclude:
- template: Security/SAST.gitlab-ci.yml
- template: Security/Dependency-Scanning.gitlab-ci.yml
- template: Security/Secret-Detection.gitlab-ci.yml
- template: Security/Container-Scanning.gitlab-ci.yml
Cinclude:
- template: Jobs/Code-Quality.gitlab-ci.yml
- template: Security/Dependency-Scanning.gitlab-ci.yml
Dinclude:
- template: Security/DAST.gitlab-ci.yml
- template: Security/License-Scanning.gitlab-ci.yml
Explanation
Comprehensive security scanning for containerized applications requires SAST for code analysis, Dependency-Scanning for vulnerable dependencies, Secret-Detection for exposed credentials, and Container-Scanning for Docker image vulnerabilities. These four templates cover static analysis, software composition analysis, secret management, and runtime security. DAST and License-Scanning are useful but not part of the core requirement. SAST and DAST alone miss dependency and container vulnerabilities. Code-Quality focuses on code maintainability rather than security vulnerabilities.
4. A company implements AWS WAF to protect their web application from common attacks. They need to configure security rules that block SQL injection attacks, XSS attempts, and requests from specific geographic locations known for malicious activity. They want to use AWS managed rule groups to minimize operational overhead. Which AWS WAF configuration approach should they use? (Select one!)
AUse AWS Managed Rules Core Rule Set for OWASP protections and add geographic restriction rules
BDeploy AWS Shield Advanced instead of AWS WAF
CConfigure CloudFront with signed URLs to restrict access
DCreate custom regex pattern sets for SQL injection and XSS detection manually
Explanation
AWS Managed Rules provide pre-configured rule groups including the Core Rule Set which protects against OWASP Top 10 vulnerabilities including SQL injection and XSS. Geographic restriction rules can be added to block traffic from specific countries. This approach minimizes operational overhead by using managed rules instead of custom patterns. Creating custom regex patterns requires more maintenance and expertise. AWS Shield Advanced protects against DDoS attacks, not application-layer attacks like SQLi and XSS. CloudFront signed URLs control access to content but do not protect against injection attacks.
5. A security operations team implements SIEM integration for a DevSecOps pipeline. Security scan results from SAST, DAST, SCA, and container scanning tools must be aggregated, correlated with runtime security events, and analyzed for patterns indicating potential breaches. Which output format standardization should be implemented for tool integration? (Select one!)
ACVSS (Common Vulnerability Scoring System) scores for severity standardization
BCycloneDX SBOM format for dependency and vulnerability tracking
CSARIF (Static Analysis Results Interchange Format) for unified vulnerability reporting
DSTIX/TAXII protocols for threat intelligence sharing
Explanation
SARIF is an OASIS standard specifically designed for static analysis tool output standardization, supported by major security tools including CodeQL, Semgrep, Trivy, and ZAP. SARIF provides a unified JSON schema for representing vulnerabilities, code locations, severity, remediation guidance, and tool metadata, enabling consistent ingestion into SIEMs and security dashboards regardless of source tool. CVSS provides severity scoring but not a complete output format for vulnerability details and code locations. CycloneDX is an SBOM format for component inventory and dependencies but not optimized for representing security scan findings with code locations and remediation steps. STIX/TAXII are threat intelligence sharing protocols for indicators of compromise, not application security scan results.
More EC-Council Practice Exams
Certified Threat Intelligence Analyst (CTIA)
CTIA · 740 questions
Certified Cybersecurity Technician (CCT)
CCT · 630 questions
Certified Secure Computer User (CSCU)
CSCU · 630 questions
EC-Council Certified Encryption Specialist (ECES)
ECES · 627 questions
Ethical Hacking Essentials (EHE)
EHE · 627 questions
ICS/SCADA Cybersecurity
ICS-SCADA · 627 questions
$17.99
One-time access to this exam
Full access to all 609 questions
Or $15/mo for all 253 exams
Detailed explanations
Free preview stays available