ECCouncil 312-97 Value Pack (Frequently Bought Together)

Sophia Mitchell, a DevSecOps Engineer at WebSecure Inc., is responsible for ensuring the security of the company's web and Node.js applications. During a routine security assessment, she suspects that some third-party JavaScript libraries used in the project might contain vulnerabilities. To automate the detection of insecure libraries, Sophia decides to use Retire.js. However, she wants a method that automatically scans and flags vulnerable JavaScript libraries during the build process, ensuring that no insecure dependencies make it into production. Which of the following Retire.js features should Sophia use to achieve this?

• A. Burp and OWASP ZAP Plugin.
• B. Grunt Plugin.
• C. Synk Scanner Plugin.
• D. Chrome and Firefox Extension.

Robin Tunney has been working as a DevSecOps engineer in an IT company located in Charleston, South Carolina. She would like to build a customized docker image using HashiCorp Packer. Therefore, she installed Packer and created a file docker-ubuntu.pkr.hcl; she then added HCL block to it and saved the file. Which of the following commands should Robin execute to build the Docker image using Packer?

• A. packer -build docker-ubuntu.pkr.hcl.
• B. packer b docker-ubuntu.pkr.hcl.
• C. packer build docker-ubuntu.pkr.hcl.
• D. packer -b docker-ubuntu.pkr.hcl.

A technology firm specializing in financial services has integrated Fortify Static Code Analyzer (SCA) with Jenkins to enforce secure coding practices within its CI/CD pipeline. The objective is to identify and remediate vulnerabilities early in the development lifecycle. After a recent build, the security team noticed that critical vulnerabilities were not flagged, despite Fortify SCA being executed within the pipeline. Jenkins logs confirmed that the scan completed successfully without any errors. However, when the security team manually executed Fortify SCA on the same codebase outside of Jenkins, multiple vulnerabilities were detected. Which of the following is the reason for the discrepancy in vulnerability detection?

• A. Jenkins lacks network permissions to access the Fortify SCA tool.
• B. The Fortify SCA plugin is incompatible with Jenkins, causing incomplete scans.
• C. The Fortify rulepack is updated, leading to missed detections in the pipeline.
• D. Post-build actions are misconfigured, preventing proper retrieval of scan results.

An enterprise healthcare application was recently targeted by a sophisticated attack. The attackers exploited misconfigured data flows and improperly secured API endpoints, exposing sensitive patient records. The DevSecOps team immediately deployed a tool to analyze the application's architecture by modeling its assets in a YAML file. This analysis revealed the exact vulnerabilities and provided detailed mitigation strategies, such as securing data flows with encryption and implementing stricter API access controls. The generated report helped the team resolve the issues swiftly and prevent future breaches. Which tool was likely used to handle this scenario?

• A. AWS Shield.
• B. Snyk.
• C. GitLab Duo.
• D. Threagile.

Emma Johnson, a DevSecOps Engineer at CloudSecure Technologies, is responsible for ensuring that open-source dependencies used in the company's software development pipeline do not introduce security vulnerabilities. Her team uses AWS CodeBuild as part of their CI/CD process to automate builds and deployments. To enhance security, Emma integrates Mend with AWS CodeBuild. Which of the following benefits does Mend's integration with AWS CodeBuild provide to Emma's team?

• A. Enhances IAM policies to restrict unauthorized access to open-source libraries.
• B. Automates scanning of source code repositories to detect security and compliance issues.
• C. Optimizes AWS CodeBuild performance by reducing build execution time.
• D. Automatically patches vulnerabilities in the source code without developer intervention.