Real 312-97 dumps Accurate Questions and Answers with Free and Fast Updates [Q52-Q71]

Q52. (Terry Diab has been working as a DevSecOps engineer in an IT company that develops software products and web applications for a call center. She would like to integrate Snyk with AWS CodeCommit to monitor and remediate vulnerabilities in the code repository. Terry pushed code to AWS CodeCommit; this triggered Amazon EventBridge Rule, which then triggered AWS CodePipeline. AWS CodePipeline passed code to Snyk CLI run. Who among the following interacts with Snyk CLI and sends the results to Snyk UI?)

AWS CodeDeploy.

AWS CodeCommit.

AWS Pipeline.

AWS CodeBuild.

Q53. (Cheryl Hines has been working as a senior DevSecOps engineer over the past 5 years in an IT company. Due to the robust features offered by Keywhiz secret management tool such as compatibility with all software, untraceable secrets, no impact of power cut or server outage, etc., Cheryl’s organization is using it for managing and distributing secrets. To add a secret using Keywhiz CLI, which of the following commands should Cheryl use?)

$ keywhiz.cli –devTrustStore –user keywhizAdmin login
$ keywhiz.cli add secret –name mySecretName < mySecretFile.

$ keywhiz.cli –devsecTrustStore –admin keywhizAdmin login
$ keywhiz.cli add secret –name mySecretName < mySecretFile.

$ keywhiz.cli –devTrustStore –admin keywhizAdmin login
$ keywhiz.cli add secret –name mySecretName < mySecretFile.

$ keywhiz.cli –DevSecTrustStore –user keywhizAdmin login
$ keywhiz.cli add secret –name mySecretName < mySecretFile.

Q54. (Jason Wylie has been working as a DevSecOps engineer in an IT company located in Sacramento, California. He would like to use Jenkins for CI and Azure Pipelines for CD to deploy a Spring Boot app to an Azure Container Service (AKS) Kubernetes cluster. He created a namespace for deploying the Jenkins in AKS, and then deployed the Jenkins app to the Pod. Which of the following commands should Jason run to see the pods that have been spun up and running?)

kubectl get pods -k Jenkins.

kubectl get pods -s jenkins.

kubectl get pods -n jenkins.

kubectl get pods -p jenkins.

Q55. (Katie Holmes is working as a DevSecOps engineer at SeCSafe Anti-virus. The DevOps team of her organization has developed a distributed application with multiple microservices. Katie deployed all the microservices to the Kubernetes nodes successfully. The DevOps team approached Katie and informed her that the application is not working. Katie wants to check whether the Kubernetes cluster is working or not.
Which of the following commands should Katie run step by step to verify that the Kubernetes is working?)

kube-etcd version kube-etcd cluster-info.

kubernetes version kubebernetes cluster-info.

kube version kube cluster-info.

kubectl version kubectl cluster-info.

Q56. (Scott Morrison is working as a senior DevSecOps engineer at SUTRE SOFT Pvt. Ltd. His organization develops software and applications for IoT devices. Scott created a user story; he then created abuser stories under the user story. After that, he created threat scenarios under the abuser story, and then he created test cases for the threat scenarios. After defining the YAML, Scott would like to push the user-story driven threat model to the ThreatPlaybook server. Which of the following command Scott should use?.)

playbook apply feature -f < path to the yaml file > -t test-project.

playbook apply feature -y < path to the yaml file > -p test-project.

playbook apply feature -f < path to the yaml file > -p test-project.

playbook apply feature -p < path to the yaml file > -t test-project.

Q57. (Frances Fisher joined TerraWolt Pvt. Ltd. as a DevSecOps engineer in 2020. On February 1, 2022, his organization became a victim of cyber security attack. The attacker targeted the network and application vulnerabilities and compromised some important functionality of the application. To secure the organization against similar types of attacks, Franches used a flexible, accurate, low maintenance vulnerability management and assessment solution that continuously scans the network and application vulnerabilities and provides daily updates and specialized testing methodologies to catch maximum detectable vulnerabilities.
Based on the above-mentioned information, which of the following tools is Frances using?)

SonarQube.

Black Duck.

BeSECURE.

Shadow Daemon.

Q58. (Robin Tunney has been working as a DevSecOps engineer in an IT company located in Charleston, South Carolina. She would like to build a customized docker image using HashiCorp Packer. Therefore, she installed Packer and created a file docker-ubuntu.pkr.hcl; she then added HCL block to it and saved the file.
Which of the following commands should Robin execute to build the Docker image using Packer?)

packer build docker-ubuntu.pkr.hcl.

packer -b docker-ubuntu.pkr.hcl.

packer b docker-ubuntu.pkr.hcl.

packer -build docker-ubuntu.pkr.hcl.

Q59. (Orange International Pvt. Ltd. is an IT company that develops software products and web applications for Android phones. The organization recognizes the importance of secure coding principles and would like to enforce it. Therefore, Orange International Pvt. Ltd. established access management, avoided reinventing the wheel, secured the weak links, implemented in-depth defense, and reduced third-party involvement in the application. Based on the above-mentioned information, which of the following secure coding principles is achieved by the organization?.)

Secure by implementation.

Secure by default.

Secure by design.

Secure by communication.

Q60. (Charlotte Flair is a DevSecOps engineer at Egma Soft Solution Pvt. Ltd. Her organization develops software and applications related to supply chain management. Charlotte would like to integrate Sqreen RASP tool with Slack to monitor the application at runtime for malicious activities and block them before they can damage the application. Therefore, she created a Sqreen account and installed Sqreen Microagent. Now, she would like to install the PHP microagent. To do so, she reviewed the PHP microagent’s compatibility, then she signed in to Sqreen account and noted the token in Notepad. Which of the following commands should Charlotte run in the terminal to install the PHP extension and the Sqreen daemon?.)

curl -shttps://download.sqreen.com/php/install.sh> sqreen-install.sh && bash sqreen-install.sh
[CHARLOTTE’S ORG TOKEN HERE] “[ CHARLOTTE’S APP NAME HERE]”.

curl -shttps://download.sqreen.com/php/install.sh< sqreen-install.sh && bash sqreen-install.sh
[CHARLOTTE’S ORG TOKEN HERE] “[ CHARLOTTE’S APP NAME HERE]”.

curl -ihttps://download.sqreen.com/php/install.sh> sqreen-install.sh && bash sqreen-install.sh
[CHARLOTTE’S ORG TOKEN HERE] “[ CHARLOTTE’S APP NAME HERE]”.

curl -ihttps://download.sqreen.com/php/install.sh< sqreen-install.sh && bash sqreen-install.sh
[CHARLOTTE’S ORG TOKEN HERE] “[ CHARLOTTE’S APP NAME HERE]”.

Q61. (Patrick Fisher is a DevSecOps engineer in an IT company that develops software products and web applications. He is using IAST to analyze code for security vulnerabilities and to view real-time reports of the security issues. Patrick is using IAST in development, QA, and production stages to detect the vulnerabilities from the early stage of development, reduce the remediation cost, and keep the application secure. How can IAST perform SAST on every line of code and DAST on every request and response?.)

Because IAST has access to server and local machine.

Because IAST has access to the code and HTTP traffic.

Because IAST has access to offline and runtime environment.

Because IAST has access to internal and external agents.

Q62. (Peter Dinklage has been working as a senior DevSecOps engineer at SacramentSoft Solution Pvt. Ltd. He has deployed applications in docker containers. His team leader asked him to check the exposure of unnecessary ports. Which of the following commands should Peter use to check all the containers and the exposed ports?)

docker ps –quiet | xargs docker inspect –all –format : Ports=.

docker ps –quiet | xargs docker inspect –format ‘: Ports=’.

docker ps –quiet | xargs docker inspect –format : Ports.

docker ps –quiet | xargs docker inspect –all –format ‘: Ports=’.

Q63. (Michael Rady recently joined an IT company as a DevSecOps engineer. His organization develops software products and web applications related to online marketing. Michael deployed a web application on Apache server. He would like to safeguard the deployed application from diverse types of web attacks by deploying ModSecurity WAF on Apache server. Which of the following command should Michael run to install ModSecurity WAF?)

sudo apt install libapache2-mod-security2 -y.

sudo apt install libapache2-mod-security2 -x.

sudo apt install libapache2-mod-security2 -w.

sudo apt install libapache2-mod-security2 -z.

Q64. (SNF Pvt. Ltd. is a software development company located in Denver, Colorado. The organization is using pytm, which is a Pythonic Framework for threat modeling, to detect security issues and mitigate them in advance. James Harden has been working as a DevSecOps engineer at SNF Pvt. Ltd. for the past 3 years. He has created a tm.py file that describes an application in which the user logs the app and posts the comments on the applications. These comments are stored by the application server in the database and AWS lambda cleans the database. Which of the following command James can use to generate a sequence diagram?)

tm.py –seq | java -Djava.awt.headless=true -jar plantuml.jar -tpng -pipe > seq.png.

tm.py –seq | java -djava.awt.headless=true -jar plantuml.jar -tpng -pipe > seq.png.

tm.py –seq | java -Djava.awt.headless=true -jar plantum.jar -tpng -pipe > seq.png.

tm.py –seq | java -djava.awt.headless=true -jar plantum.jar -tpng -pipe > seq.png.

Q65. (Kevin Williamson has been working as a DevSecOps engineer in an MNC company for the past 5 years. In January of 2017, his organization migrated all the applications and data from on-prem to AWS cloud due to the robust security feature and cost-effective services provided by Amazon. His organization is using Amazon DevOps services to develop software products securely and quickly. To detect errors in the code and to catch bugs in the application code, Kevin integrated PHPStan into the AWS pipeline for static code analysis. What will happen if security issues are detected in the application code?.)

The integrated PHPStan into the AWS pipeline will invoke AWS CloudFormation to parse and send result to the security hub.

The integrated PHPStan into the AWS pipeline will invoke AWS Config to parse and send result to the security hub.

The integrated PHPStan into the AWS pipeline will invoke AWS Elastic BeanStalk to parse and send result to the security hub.

The integrated PHPStan into the AWS pipeline will invoke the AWS Lambda function to parse and send result to the security hub.

Q66. (Steven Smith has been working as a DevSecOps engineer in an IT company that develops software products related to the financial sector. His team leader asked him to integrate Conjur with Jenkins to secure the secret credentials. Therefore, Steven downloaded Conjur.hpi file and uploaded it in the Upload Plugin section of Jenkins. He declared host and layers, and declared the variables. Which of the following commands should Steven use to set the value of variables?)

$ conjur variable set -i < policy-path-of-variable-name > -v < secret-value >.

$ conjur variable set -p < policy-path-of-variable-name > -s < secret-value >.

$ conjur variable set -s < policy-path-of-variable-name > -p < secret-value >.

$ conjur variable set -v < policy-path-of-variable-name > -i < secret-value >.

Q67. (DWART is an IT company that develops cyber security software and web applications. The organization ensures that all users should be identified and authorized, enforces proper auditing, secures data at rest, ensures that the attacker cannot bypass the security layers, implements multiple layers of defense, maintains proper data integrity, and performs proper input validation for the application. Based on the above-mentioned information, which of the following secure coding principles is achieved by DWART?.)

Secure by design.

Secure by implementation.

Secure by default.

Secure by communication.

Q68. (Matt LeBlanc has been working as a DevSecOps engineer in an IT company that develops software products and web applications for IoT devices. His team leader has asked him to use GitRob tool to find sensitive data in the organizational public GitHub repository. To install GitRob, Matt ensured that he has correctly configured Go >= 1.8 environment and that $GOPATH/bin is in his $PATH. The GitHub repository URL from which he is supposed to install the tool ishttps://github.com/michenriksen/gitrob. Which of the following command should Matt use to install GitRob?.)

$ go get github.com/michenriksen/gitrob.

$ go get gitrob github.com/michenriksen/gitrob.

$ go git github.com/michenriksen/gitrob.

$ go git gitrob github.com/michenriksen/gitrob.

Q69. (Brady Coleman is a senior DevSecOps engineer at CloudVac Security Private Ltd. He has created a new container named “eccbrad” from the centos:7 image using the command docker run -i -t –name geeklab centos:7 /bin/bash. Now, Brady wants to install the httpd package inside the eccbrad container. Which of the following commands should Brady use to install the httpd package inside the container?)

sudo install-httpd.

sudo install httpd.

yum install-httpd.

yum install httpd.

Q70. (Timothy Dalton has been working as a senior DevSecOps engineer in an IT company located in Auburn, New York. He would like to use Jenkins for CI and Azure Pipelines for CD to deploy a Java-based app to an Azure Container Service (AKS) Kubernetes cluster. Before deploying Azure Kubernetes Service (AKS) Cluster, Timothy wants to create a Resource group named Jenkins in southindia location. Which of the following commands should Timothy run?.)

az grp create –n Jenkins –loc southindia.

azure group create –n Jenkins –loc southindia.

azure group create –name Jenkins –location southindia.

az group create –name Jenkins –location southindia.

Q71. (Steven Gerrard has been working as a DevSecOps engineer at an IT company that develops software products and applications related to the healthcare industry. His organization has been using Azure DevOps services to securely and quickly develop software products. To ensure that the deployed infrastructure is in accordance with the architecture and industrial standards and the security policies are appropriately implemented, she would like to integrate InSpec with Azure. Therefore, after installation and configuration of InSpec, she created InSpec profile file and upgraded it with personal metadata and Azure resource pack information; then she wrote the InSpec tests. Which of the following commands should Steven use to run InSpec tests to check the compliance of Azure infrastructure?)

inspec exe inspec-tests/integration/ -t azure://.

inspec exec inspec-tests/integration/ -it azure://.

inspec exec inspec-tests/integration/ -t azure://.

inspec exe inspec-tests/integration/ -it azure://.