EC-Council · ECDE
Certified DevSecOps Engineer (ECDE) Practice Tests
Validates the ability to integrate security practices into DevOps pipelines and continuous delivery workflows, covering DevSecOps culture, threat modeling, secure code review, automated security testing, container security, and security monitoring throughout the software development lifecycle.
Exam Details
Practice Questions
609
≈ 4 practice exams
Duration
240 minutes
Passing Score
70%
Difficulty
AssociateLast Updated
Feb 2026
Certified DevSecOps Engineer (ECDE) Practice Exam Preparation
Use this ECDE practice exam to prepare for Certified DevSecOps Engineer (ECDE) with realistic questions, detailed explanations, and focused study modes. The practice bank includes 609 questions for EC-Council ECDE, so you can review the exam steadily instead of relying on one long cram session.
As you practice, pay extra attention to patterns in your missed answers. Start with short sessions to identify weak areas, then move into timed quizzes once your accuracy is consistent.
The explanations are especially useful when you want to connect exam wording to the responsibilities and scenarios described in the official certification guidance. Use the free preview first, then unlock the full question bank when you are ready to build a complete study routine.
Exam Overview
The EC-Council Certified DevSecOps Engineer (E|CDE), exam code 312-97, is a comprehensive certification that validates a professional's ability to embed security practices across the entire DevOps pipeline. The program covers all eight stages of the DevOps lifecycle — from planning and coding through building, testing, releasing, deploying, operating, and monitoring — ensuring that security is treated as a shared, continuous responsibility rather than an afterthought. Candidates learn to apply threat modeling, secure coding guidelines, static and dynamic application security testing (SAST/DAST), infrastructure as code (IaC) security, container security, and runtime monitoring using industry tools such as SonarQube, Snyk, Checkmarx, Jenkins, Terraform, and Docker Bench.
The certification is notably hands-on, featuring over 80 guided lab exercises delivered in virtual environments spanning Amazon Web Services (AWS), Microsoft Azure, and on-premises platforms. This dual focus on theoretical DevSecOps principles and practical tool-based implementation distinguishes E|CDE from more conceptual security credentials, making it one of the most lab-intensive DevSecOps certifications available. The program has been updated to incorporate AI-powered security tooling and cloud-native security patterns relevant to modern CI/CD workflows.
Who Should Take This Exam
The E|CDE is designed for mid-career technology professionals who work at the intersection of software development, operations, and security. Primary target roles include DevOps engineers looking to formalize their security knowledge, application security specialists transitioning into DevSecOps, software engineers and QA testers responsible for secure delivery pipelines, and cybersecurity engineers or analysts who need to integrate security tooling into CI/CD workflows. Professionals holding EC-Council's Certified Application Security Engineer (CASE) credential or similar AppSec certifications will find E|CDE a natural progression.
EC-Council recommends candidates have at least two years of experience in information security, along with familiarity with SDLC concepts, automation tools, and scripting languages such as Python or PowerShell. The certification suits professionals targeting specialized roles such as DevSecOps Engineer, Cloud DevSecOps Engineer, AWS/Azure DevSecOps Engineer, or CI/CD Security Engineer.
Prerequisites
EC-Council requires applicants who wish to sit for the exam without attending official training to have a minimum of two years of work experience in the information security domain and to submit an eligibility application with a non-refundable fee of USD $100. Candidates who complete an authorized EC-Council training course have the application fee included and gain direct exam eligibility upon course completion.
While there are no mandatory prerequisite certifications, candidates are strongly advised to arrive with a working understanding of application security concepts, the Software Development Lifecycle (SDLC), and CI/CD pipeline fundamentals. Familiarity with at least one cloud platform (AWS or Azure), containerization concepts (Docker, Kubernetes), and basic scripting will allow candidates to make full use of the lab-heavy curriculum and perform well on exam questions focused on practical tool configuration and pipeline integration.
Exam Format
The E|CDE exam (code 312-97) consists of 100 multiple-choice questions and must be completed within 240 minutes (4 hours). The exam is closed-book and is delivered exclusively through the ECC Exam Centre portal; it is not available at third-party proctoring sites. A passing score of 70% (70 out of 100 correct) is required. The exam fee is USD $550, and the voucher is valid for one year from the date of receipt.
There are no published unscored or survey questions. Upon passing, certified professionals are enrolled in EC-Council's Continuing Education Scheme and must pay an annual maintenance fee of USD $80 to keep the credential active.
Skills Measured
- 1.Domain 1 – Understanding DevOps Culture: Foundational DevOps principles, collaboration models between development and operations teams, CI/CD concepts, automation philosophies, and continuous improvement through feedback loops.
- 2.Domain 2 – Introduction to DevSecOps: Integrating security into DevOps lifecycles, shifting left on security, DevSecOps culture and organizational adoption, security automation fundamentals, monitoring, and key toolchain considerations.
- 3.Domain 3 – DevSecOps Pipeline: Plan Stage: Security requirements gathering, threat modeling methodologies and tools (Threat Dragon, ThreatModeler, Threatspec), risk assessment during project planning, and alignment of security objectives with business goals.
- 4.Domain 4 – DevSecOps Pipeline: Code Stage: Secure coding practices, static application security testing (SAST) integration in IDEs and repositories, secret detection, dependency scanning, and tools such as SonarQube, Snyk, and Checkmarx.
- 5.Domain 5 – DevSecOps Pipeline: Build and Test Stage: Automated security testing within CI pipelines (SAST, DAST, IAST), security policy as code (SPACK), integration with build tools such as Jenkins, Bamboo, TeamCity, and Gradle, and software composition analysis.
- 6.Domain 6 – DevSecOps Pipeline: Release and Deploy Stage: Infrastructure as Code (IaC) security with Terraform and CloudFormation, container security hardening (Docker Bench), secure deployment strategies, runtime application self-protection (RASP), and configuration management.
- 7.Domain 7 – DevSecOps Pipeline: Operate and Monitor Stage: Continuous security monitoring, SIEM tool implementation, logging strategies, incident detection and response, cloud-native monitoring on AWS and Azure, and feedback loops for security improvement.
Study Tips
- Use the official EC-Council courseware as your primary study resource — the seven modules map directly to the seven exam domains, and the lab scenarios are closely aligned with practical exam questions on tool configuration and pipeline integration.
- Complete as many of the 80+ hands-on labs as possible, especially the 32 AWS labs and 29 Azure labs, since a significant portion of exam questions tests applied knowledge of cloud-native DevSecOps tool deployment rather than purely conceptual understanding.
- Build a personal reference sheet for each pipeline stage (Plan, Code, Build/Test, Release/Deploy, Operate/Monitor) listing the key tools, their purpose, and when to use them — for example, Threat Dragon for threat modeling, Snyk/SonarQube for SAST, StackHawk for DAST, and Docker Bench for container hardening.
- Study the EDUSUM 312-97 syllabus breakdown and practice with sample questions from EDUSUM's free question bank to get familiar with EC-Council's MCQ phrasing style and identify knowledge gaps in specific domains before exam day.
- Review EC-Council's DevSecOps-focused blog posts and whitepapers on the Cybersecurity Exchange (eccouncil.org/cybersecurity-exchange/devsecops/) to reinforce understanding of the 'shift-left' philosophy, DevSecOps cultural adoption challenges, and AI-integrated security tooling covered in the updated curriculum.
- Focus exam preparation time proportionally on the five pipeline-stage domains (Domains 3–7) rather than the introductory domains, as practical pipeline security decisions and tool configurations represent the majority of exam items.
- If self-studying without official training, ensure you meet the two-year information security experience requirement and submit the eligibility application with the USD $100 fee well in advance of your target exam date, as processing takes time.
Career Benefits
Holding the E|CDE credential positions professionals for high-demand roles in the DevSecOps specialty, which sits at the convergence of software engineering, cloud operations, and cybersecurity — a skills combination that remains scarce in the market. Certified professionals typically pursue titles such as DevSecOps Engineer, Cloud DevSecOps Engineer (AWS or Azure-focused), Infrastructure DevSecOps Engineer, or DevSecOps CI/CD Specialist. According to EC-Council's published data, the average annual salary for a DevSecOps engineer in the United States is approximately USD $139,479, with entry-level positions starting around USD $118,733 and experienced practitioners earning upward of USD $172,500.
Compared to broader security credentials such as CompTIA Security+ or even CEH, E|CDE is deliberately narrow and applied, making it a strong differentiator for professionals who want to demonstrate pipeline-specific security engineering skills to employers adopting DevSecOps practices. The certification's hands-on lab focus on both AWS and Azure cloud environments also complements cloud platform certifications and makes the credential appealing to organizations undergoing cloud-native transformation. Annual continuing education requirements ensure the credential stays current as the tooling landscape evolves.
Sample Questions
5 sample questions with answers and explanations. The full bank has 609 questions, enough for 4 full-length practice exams.
Preview — answers shown1. A company implements AWS CodePipeline for their application deployment. The pipeline must retrieve database credentials from AWS Secrets Manager, rotate secrets automatically every 30 days using a Lambda function, and ensure the application retrieves the current secret version at runtime. Which AWS CLI commands correctly configure automatic rotation? (Select one!)
Aaws secretsmanager update-secret --secret-id db-credentials --rotation-enabled --rotation-interval 30
Baws secretsmanager put-secret-value --secret-id db-credentials --rotation-lambda rotateSecret --auto-rotate true
Caws secretsmanager rotate-secret --secret-id db-credentials --rotation-lambda-arn arn:aws:lambda:us-east-1:123456789012:function:rotateSecret --rotation-rules AutomaticallyAfterDays=30
Daws secretsmanager enable-rotation --secret-id db-credentials --lambda-function rotateSecret --schedule-expression 'rate(30 days)'
Explanation
The rotate-secret command with --rotation-lambda-arn specifying the full Lambda ARN and --rotation-rules AutomaticallyAfterDays=30 correctly configures automatic rotation every 30 days. The update-secret command does not have --rotation-enabled or --rotation-interval parameters. The enable-rotation command does not exist in AWS CLI. The put-secret-value command is for updating secret values not configuring rotation schedules.
2. An organization implements Docker container security and needs to ensure containers run with minimal privileges and cannot escalate privileges. Which three Docker security flags should they configure when running containers? (Select three!)
Multiple correct answersA--security-opt=no-new-privileges:true
B--cap-drop=ALL
C--user 1000:1000
D--privileged
E--cap-add=SYS_ADMIN
F--read-only
Explanation
The no-new-privileges security option prevents privilege escalation, cap-drop=ALL removes all Linux capabilities, and user 1000:1000 runs the container as a non-root user. These three flags work together to enforce least privilege. The privileged flag grants excessive permissions and contradicts security hardening. The cap-add=SYS_ADMIN adds administrative capabilities that should be avoided. While read-only filesystem is a good security practice, it is not specifically related to preventing privilege escalation.
3. An organization implements Falco for runtime threat detection in a Kubernetes cluster. Security requirements mandate alerts for any shell execution inside containers and file modifications in /etc directory. Which Falco rule components must be configured? (Select two!)
Multiple correct answersADefine condition field with spawned_process and container filters combined with shell_procs macro
BSet priority field to EMERGENCY for all detected events
CConfigure output field to send alerts to Falcosidekick for routing to Slack and PagerDuty
DCreate list containing authorized shell binaries like bash, sh, zsh for whitelisting
EEnable gVisor integration for userspace kernel monitoring
Explanation
Falco rules require a condition field that defines when alerts trigger, using filters like spawned_process, container, and macros like shell_procs to detect shell execution. The output field specifies alert formatting and routing, with Falcosidekick commonly used to forward alerts to external systems like Slack and PagerDuty. Setting priority to EMERGENCY for all events is incorrect as priorities should match threat severity levels including WARNING, ERROR, CRITICAL, and EMERGENCY. While lists can define authorized binaries, the question asks about detecting violations, not whitelisting. gVisor integration is an advanced feature for syscall monitoring but is not a required rule component for basic shell and file detection.
4. A cloud-native startup implements GCP Cloud Build with artifact scanning and binary authorization. Production deployments must only allow container images signed by authorized build pipelines. Which configuration enforces this requirement? (Select one!)
AUse Cloud Build triggers with branch protection requiring manual approval before production deployments
BCreate Binary Authorization policy requiring attestations from authorized build attestors before GKE deployment
CConfigure Cloud Build to generate container images and enable Artifact Registry vulnerability scanning with severity thresholds
DImplement Cloud Armor security policies to inspect container images during deployment to GKE clusters
Explanation
Binary Authorization policies enforce that only container images with valid attestations from authorized build attestors can be deployed to GKE, preventing deployment of unsigned or unauthorized images. This cryptographically verifies image provenance and approval. Vulnerability scanning detects vulnerabilities but does not enforce image signing or authorized build requirements. Cloud Armor is a WAF for HTTP/HTTPS traffic, not a container image verification mechanism. Cloud Build triggers with manual approval provide workflow control but do not cryptographically verify image signatures or enforce attestation-based authorization.
5. A development team uses Terraform to provision AWS infrastructure including VPCs, EC2 instances, and RDS databases. The Terraform state file contains sensitive information including database passwords and API keys. The team uses S3 backend for state storage. Which security configurations must be implemented to protect the state file? (Select two!)
Multiple correct answersAEnable S3 bucket versioning to maintain state file history and recover from corruption
BConfigure S3 server-side encryption with AES-256 or AWS KMS keys using the encrypt parameter
CImplement DynamoDB table for state locking to prevent concurrent modification conflicts
DMark all sensitive variables with the sensitive attribute to redact values from CLI output
EStore Terraform state files in Git repository with encryption using git-crypt
Explanation
S3 server-side encryption with encrypt parameter is critical for protecting state files at rest containing sensitive data like passwords and keys. DynamoDB state locking prevents concurrent state modifications that could corrupt the state file or expose secrets during conflicting operations. These configurations are specified in the Terraform backend block. Bucket versioning helps with recovery but does not protect sensitive data from unauthorized access. Marking variables as sensitive only redacts them from console output and logs but does not encrypt state files. Storing state files in Git is explicitly discouraged as it exposes secrets to version control history even with encryption.
More EC-Council Practice Exams
Certified Cloud Security Engineer (CCSE)
CCSE · 624 questions
Certified Network Defender (CND)
CND · 562 questions
Certified Cybersecurity Technician (CCT)
CCT · 630 questions
Digital Forensics Essentials (DFE)
DFE · 626 questions
EC-Council Certified Disaster Recovery Professional (EDRP)
EDRP · 623 questions
Certified Application Security Engineer .NET (CASE-.NET)
CASE-.NET · 625 questions
$17.99
One-time access to this exam
609 questions (4 practice exams' worth)
Unlimited timed exam simulations
Yours forever — no subscription
Detailed explanations
Free preview stays available