Free 312-97 Practice Test Questions and Answers (2026)

The scenario describes a gamified, competitive, team-building event for finding and fixing bugs for rewards. This is the exact description of AWS BugBust. It is an AWS service that transforms bug fixing into a game, allowing developers to compete in challenges to resolve software bugs identified by Amazon CodeGuru. Participants earn points for each bug fixed, climb a leaderboard, and can win prizes, matching the experience described for Sarah.

A. AWS BugFixer is not an official AWS service or program; the name is a plausible but incorrect distractor.

B. AWS BugFinder is not an official AWS service or program. Amazon CodeGuru is the service that finds bugs.

C. AWS BugHunt is not an official AWS service or program, though the name sounds similar to the concept of a bug bounty.

- Amazon Web Services, "AWS BugBust." Accessed October 2023. (https://aws.amazon.com/bugbust/). The official product page states, "AWS BugBust is the first global bug-bashing challenge for developers to fix 1 million bugs..."

- Amazon Web Services, "Announcing AWS BugBust – A New Way to Gamify and Improve Code Quality," AWS News Blog, June 23, 2021. (https://aws.amazon.com/blogs/aws/announcing-aws-bugbust-a-new-way-to-gamify-and-improve-code-quality/). This official announcement details the gamified nature of the event.

Integrating a tool like ThreatModeler into an automated CI/CD workflow like Azure Pipelines requires programmatic interaction. A bidirectional API is essential for a true DevSecOps pipeline. It allows Azure Pipelines to automatically trigger actions in ThreatModeler (e.g., update a threat model based on new code) and, crucially, receive feedback (e.g., risk analysis, policy compliance status). This feedback enables the pipeline to make automated decisions, such as failing a build if unacceptable security risks are identified, thus creating a closed feedback loop.

B. A unidirectional API would only allow one-way communication (e.g., pipeline to ThreatModeler), preventing the pipeline from receiving results to act upon.

C. A unidirectional UI is for manual user interaction and is not suitable for automating a CI/CD pipeline.

D. A bidirectional UI is also for human interaction and cannot be used for automated integration between two services like Azure Pipelines and ThreatModeler.

1. ThreatModeler. (n.d.). DevSecOps & CI/CD Integration. Retrieved from https://threatmodeler.com/devsecops-cicd-integration/.

"ThreatModeler provides a two-way API connector that allows for seamless integration with JIRA, Jenkins, and other CI/CD pipeline tools." This explicitly mentions the bidirectional (two-way) API for integration.

2. ThreatModeler. (n.d.). ThreatModeler API Documentation. Retrieved from https://docs.threatmodeler.com/docs/threatmodeler-apis. The documentation details the API endpoints that allow external tools to both push data to and pull data from the ThreatModeler platform, confirming its bidirectional nature for automation.

Out-of-Band Application Security Testing (OAST) is a technique used to detect vulnerabilities that are not discoverable through traditional request-and-response scanning methods. Burp Suite's implementation of OAST is the Burp Collaborator. It works by sending payloads that cause the target application to interact with a Burp-controlled server over an external channel (e.g., DNS, HTTP). These "invisible" or out-of-band interactions confirm vulnerabilities like blind SQL injection or blind SSRF with high confidence, which significantly minimizes false positives compared to inferential-based scanning techniques.

B. QAST is not a recognized standard acronym within the application security testing domain.

C. MAST stands for Mobile Application Security Testing, which is a broad category of testing focused on mobile apps, not a specific technology for finding invisible vulnerabilities.

D. NAST is not a recognized standard acronym within the application security testing domain.

1. PortSwigger. "What is OAST (out-of-band application security testing)?". Web Security Academy. PortSwigger. "OAST can be used to detect issues that are completely invisible in the application's responses, such as blind SQL injection." (Source: https://portswigger.net/web-security/oast).

2. PortSwigger. "Burp Collaborator". Burp Suite Documentation. PortSwigger. "Burp Collaborator is a network service that Burp Suite uses to help discover many kinds of vulnerabilities... by inducing a target application to interact with the Collaborator server." (Source: https://portswigger.net/burp/documentation/collaborator).

GitLab CI/CD pipelines are configured using a YAML file named .gitlab-ci.yml located in the project's root directory. To integrate an external tool like Checkmarx, its predefined template is included in the main .gitlab-ci.yml file using the include: keyword. This allows the pipeline to execute the jobs defined in the Checkmarx template. The other filenames are not the standard convention recognized by GitLab for CI/CD configuration.

A. gitlab-cd.yml is not the standard filename for GitLab CI/CD configuration. GitLab specifically looks for .gitlab-ci.yml.

B. gitlab-ci/cd.yml is an incorrect filename and path. The configuration file must be in the project's root directory.

C. gitlab.yml is not the correct filename for defining CI/CD pipelines in GitLab.

1. GitLab Documentation. (n.d.). The .gitlab-ci.yml file. GitLab Docs. Retrieved from https://docs.gitlab.com/ee/ci/yaml/. In the introduction, it states, "To use GitLab CI/CD, you start with a .gitlab-ci.yml file in the root of your project."

2. GitLab Documentation. (n.d.). Keyword reference for the .gitlab-ci.yml file - include. GitLab Docs. Retrieved from https://docs.gitlab.com/ee/ci/yaml/index.html#include. This section details how to use the include keyword to incorporate external YAML files, including remote ones via URL.

3. Checkmarx Documentation. (2023). GitLab Integration. Retrieved from https://checkmarx.com/resource/documents/en/34965-6413-gitlab-integration.html. The integration guide specifies adding the Checkmarx template to the .gitlab-ci.yml file.

The scenario involves a Docker container created from the centos:7 image. CentOS 7 uses the Yellowdog Updater, Modified (YUM) as its default package manager. To install a software package like the Apache HTTP Server (httpd) inside this container, the correct command is yum install httpd. Since Docker containers often run the initial process as the root user by default, sudo is typically not required. The command yum install instructs the YUM package manager to download and install the specified package and its dependencies.

A. install-httpd is not a standard command, and sudo is likely unnecessary as the default user in a container is root.

B. install is not the correct command for the YUM package manager; yum is the command-line utility to be used.

C. The syntax yum install-httpd is incorrect. A space is required between the install action and the package name httpd.

- Red Hat. (2023). Chapter 9. Installing, removing, and upgrading packages. RHEL 7 System Administrator's Guide. Retrieved from https://access.redhat.com/documentation/en-us/redhatenterpriselinux/7/html/systemadministratorsguide/ch-yum. Section 9.2, "Installing Packages," specifies the command syntax as yum install packagename.

- Docker Inc. (n.d.). docker run reference. Docker Docs. Retrieved from https://docs.docker.com/engine/reference/run/. The documentation explains how containers are created from images. The behavior inside the container is determined by the base image's operating system, which is CentOS 7.

In a Gruntfile you enable any externally-installed Grunt plugin with the API call

grunt.loadNpmTasks('plugin-name');.

The retire.js Grunt wrapper is named “grunt-retire”, therefore the exact call must be

grunt.loadNpmTasks('grunt-retire');.

A. Method name misspelled and preceded by hyphen; not a Grunt API.

B. Singular form loadNpmTask() does not exist in Grunt API.

D. Same singular error; API requires the final “s”.

1. GruntJS Documentation, “loadNpmTasks(taskName)”, https://gruntjs.com/api/grunt, API section, ¶2.

2. Retire.js Grunt plugin README, GitHub project UnkL4b/grunt-retire, Usage example line 14.

Jira uses a proprietary query language called Jira Query Language (JQL) for searching issues. JQL provides a powerful and flexible way to define complex search criteria that go beyond the basic search functionality. Users can construct queries using fields (e.g., project, status, assignee), operators (e.g., =, !=, IN), and keywords (e.g., AND, OR). This allows engineers like Kevin to precisely filter and find issues related to specific builds, deployments, or statuses directly within Jira.

A. Java Query Language (JPQL) is used for database queries in Java Persistence API (JPA) applications and is unrelated to searching within the Jira user interface.

B. Structured Query Language (SQL) is used for managing data in relational databases. While Jira has a database backend, JQL is the abstracted language provided to users for searching.

C. "Atlassian Query Language" is not the official name. While Atlassian develops Jira, the specific language for this product is officially named Jira Query Language (JQL).

1. Atlassian. "What is JQL?". Jira Software Cloud documentation. Atlassian. "Jira Query Language (JQL) is the most powerful and flexible way to search for your issues in Jira." (Source: https://support.atlassian.com/jira-software-cloud/docs/what-is-jql/).

2. Atlassian. "Advanced searching". Jira Software Cloud documentation. Atlassian. This guide provides a complete reference for JQL syntax, fields, operators, and keywords. The entire document refers to the language as JQL or Jira Query Language. (Source: https://support.atlassian.com/jira-software-cloud/docs/advanced-searching/).

Bundler-Audit is a command-line Software Composition Analysis (SCA) tool specifically designed for Ruby applications. It scans the Gemfile.lock file to check for dependencies (gems) with known security vulnerabilities. It cross-references the gem versions against the Ruby Advisory Database. This tool is ideal for integration into a DevSecOps CI/CD pipeline to automate security checks for Ruby dependencies, directly addressing the scenario's requirement.

A. Bandit is a Static Application Security Testing (SAST) tool designed to find common security issues in Python code, not an SCA tool for Ruby.

C. Retire.js is a tool focused on detecting the use of JavaScript libraries with known vulnerabilities, not Ruby dependencies.

D. Tenable.io is a comprehensive vulnerability management platform, not a specialized, lightweight SCA tool for integrating directly into a Ruby development workflow.

- rubysec, "bundler-audit GitHub Repository," README.md. Accessed October 2023. (https://github.com/rubysec/bundler-audit). The official project documentation describes its function as "Patch-level verification for Bundler."

- OWASP Foundation, "OWASP Software Component Analysis." Accessed October 2023. (https://owasp.org/www-community/ComponentAnalysis). This page lists various SCA tools, categorizing them by language and function, aligning Bundler-Audit with Ruby dependency checking.

Jenkins plugins are packaged and distributed as .hpi files (Hudson/Jenkins Plugin Interface). To manually install a plugin, an administrator must obtain this .hpi file. The installation is performed via the Jenkins web UI by navigating to "Manage Jenkins" > "Manage Plugins" > "Advanced" tab. In the "Deploy Plugin" section (previously "Upload Plugin"), the administrator can upload the .hpi file, after which a Jenkins restart is typically required to activate the plugin. This method is used when the Jenkins instance cannot access the public update center or for installing custom-developed plugins.

A. A .conf file is a generic configuration file format and is not used for packaging Jenkins plugins.

B. A .war (Web Application Archive) file is used to package an entire Java web application, such as Jenkins itself, not individual plugins.

C. A .zip file is a generic archive format; while a .hpi file is technically a ZIP archive, Jenkins specifically requires the .hpi extension for recognition.

1. Jenkins User Documentation, "Managing Plugins," section "Advanced installation." The documentation states: "If you have a plugin in .hpi format, you can install it by uploading the file from this section." (Source: jenkins.io/doc/book/managing/plugins/)

2. CloudBees, "How to install a plugin in Jenkins," section "Advanced installation." This official vendor documentation details the process of uploading a .hpi file through the Advanced tab in the plugin manager. (Source: cloudbees.com/blog/how-to-install-a-plugin-in-jenkins)

The InSpec command-line tool uses the exec action to execute a compliance profile against a target. The profile's location is provided as an argument (e.g., inspec-tests/integration/). To specify the target infrastructure, the -t (or --target) flag is used. For scanning Azure resources, InSpec uses the target URI azure://. Therefore, the command inspec exec inspec-tests/integration/ -t azure:// correctly combines the action, profile path, and target flag to initiate a compliance scan against the configured Azure environment.

A. The command to execute a profile is exec, not exe. This option uses the incorrect command action.

B. The -it flag is not a valid InSpec option for specifying a target. This syntax is commonly associated with Docker, not InSpec.

D. This option contains two errors: the incorrect command action exe and the invalid flag -it for specifying the target.

Chef InSpec Documentation, "inspec exec". The documentation specifies inspec exec as the command for running profiles. It also details the use of the --target (or -t) flag to specify a remote host.

Chef InSpec on Azure Documentation, "Authenticate to Azure". The official documentation provides examples for running InSpec against Azure, consistently using the format inspec exec -t azure://.... (Section: Run InSpec).

The command provided is curl -LJO https://github.com/whitesource/unified-agent-distribution/raw/master/standAlone/wssagent.sh. The curl utility is used to transfer data from or to a server. The -O flag specifically instructs curl to write the output to a local file named like the remote file. In this URL, the remote file is wssagent.sh. Therefore, executing this command will download the file and save it with the name wssagent.sh on the local CodeBuild server.

B. sswagent.sh is an incorrect filename; the URL clearly points to a file named wssagent.sh.

C. cbsagent.sh is an incorrect filename. The command downloads the file specified in the URL, not one named after the service (CodeBuild Server).

D. awsagent.sh is an incorrect filename. The file is sourced from a WhiteSource (now Mend) GitHub repository, not a generic AWS agent.

- Mend. (n.d.). AWS CodeBuild Integration. Mend Developer Documentation. Retrieved from https://docs.mend.io/bundle/integrations/page/awscodebuildintegration.html. (The official documentation for the integration specifies using the Unified Agent and provides the command to download wssagent.sh.)

- GitHub, Inc. (n.d.). whitesource/unified-agent-distribution repository. Retrieved from https://github.com/whitesource/unified-agent-distribution/blob/master/standAlone/wssagent.sh. (The source repository itself confirms the name of the script file is wssagent.sh.)

- curl project. (n.d.). curl(1) man page. Retrieved from https://curl.se/docs/manpage.html#-O. (The official curl documentation explains that the -O option saves the file with its remote name.)

ThreatPlaybook is a DevSecOps tool for user-story-driven threat modeling. According to its command-line interface (CLI) documentation, the command to apply or push a threat model defined in a feature file to a specific project is playbook apply feature. This command requires the -f flag to specify the path to the YAML feature file and the -p flag to specify the target project name on the ThreatPlaybook server. Therefore, the correct syntax is playbook apply feature -f -p test-project.

A. This command incorrectly uses the -t flag for the project name. The correct flag for specifying the project in ThreatPlaybook is -p.

B. This command incorrectly uses the -y flag to specify the YAML file. The correct flag for specifying the feature file is -f.

D. This command incorrectly uses -p for the file and -t for the project, reversing and using the wrong flags for both arguments.

1. we45. (n.d.). ThreatPlaybook Wiki. GitHub. Retrieved from https://github.com/we45/ThreatPlaybook/wiki. (The official project wiki provides documentation and examples for CLI usage).

2. we45. (n.d.). ThreatPlaybook CLI. ThreatPlaybook Documentation. The tool's built-in help (playbook apply feature --help) and official documentation specify that -f or --featurefile is used for the file and -p or --project is used for the project name.

SonarLint is an IDE extension that provides on-the-fly feedback to developers as they write code. It detects and highlights bugs, code smells, and security vulnerabilities directly in the editor. This matches the requirement of fixing issues before the code is committed by providing immediate feedback and clear remediation guidance. It helps developers "shift left," addressing security concerns early in the development lifecycle.

B. Arachni is a Dynamic Application Security Testing (DAST) scanner, which analyzes running web applications, not static code before commit.

C. OWASP ZAP is primarily a DAST tool used for penetration testing of running web applications, not for static code analysis in an IDE.

D. Tenable.io is a comprehensive vulnerability management platform for scanning infrastructure and applications, not an IDE-based tool for pre-commit code analysis.

1. SonarSource. (n.d.). What is SonarLint? SonarLint Official Documentation. Retrieved from https://www.sonarlint.org/

"SonarLint is a FREE and Open Source IDE extension that identifies and helps you fix quality and security issues as you write code."

2. Cornell University, Department of Computer Science. (n.d.). CS 5152: Software Engineering - Tools. Retrieved from https://www.cs.cornell.edu/courses/cs5152/2020sp/tools.html. This courseware lists SonarLint as a static analysis tool for improving code quality.

This question appears to be based on a flawed premise, as none of the options correctly set an environment variable in a standard shell. The correct syntax is export VARNAME="value". However, evaluating the given choices, echo is the most plausible intended answer in a non-standard scenario. The command echo BURPSCANURL = http://target-website.com. simply prints the literal string to standard output. A custom Jenkins plugin or subsequent build step could be configured to parse this output from the build log to retrieve the target URL. The other commands (sudo, grep, cat) have entirely different functions and are completely incorrect for this purpose.

A. sudo is for executing commands with superuser privileges. It is also syntactically incorrect for variable assignment due to the spaces around =.

B. grep is a command-line utility for searching plain-text data sets for lines that match a regular expression. It does not set variables.

C. cat is a command for concatenating and displaying files. It is not used for variable assignment or printing literal strings in this manner.

1. Jenkins Documentation, "Using a Jenkinsfile", Section: "Setting environment variables". The official documentation shows the correct syntax is environment { MYVAR = 'value' } in declarative pipelines or export MYVAR='value' in shell scripts. (https://www.jenkins.io/doc/book/pipeline/jenkinsfile/)

2. The GNU Bash Reference Manual, Section 3.7.1 "Simple Commands". This official documentation for the Bash shell specifies that variable assignments must not have spaces around the = character. (https://www.gnu.org/savannah-checkouts/gnu/bash/manual/bash.html#Simple-Commands)

3. MIT, "The Missing Semester of Your CS Education," The Shell Lecture Notes. The courseware demonstrates the correct syntax for variable assignment as foo=bar, without spaces. (https://missing.csail.mit.edu/2020/shell-tools/)

The Anchore Grype tool is used to scan container images and filesystems for vulnerabilities. The command grype initiates a scan. To perform a more comprehensive scan that includes all layers of a container image, not just the squashed final layer, the --scope all-layers flag should be used. This ensures vulnerabilities from base images and intermediate layers are also detected. While the provided option has a syntax error (a trailing period and a missing target), it correctly identifies the essential --scope all-layers flag for a thorough scan as requested. The correct full command syntax would be grype --scope all-layers.

B. grype packages is not a valid command for initiating a vulnerability scan; it is used for listing packages, and the syntax is incorrect.

C. grype packages . is an invalid command. The packages subcommand is for listing packages from a previously generated scan result, not for scanning.

D. grype . is a valid command to scan the current directory's filesystem, but it uses the default 'squashed' scope, which is less comprehensive than 'all-layers' for images.

- Anchore Grype Documentation. (n.d.). README.md. GitHub. Retrieved from https://github.com/anchore/grype. In the "Usage" section, the basic command is shown as grype , and the --scope flag is detailed under the "Configuration" or command-line options section, specifying its use for all-layers scanning.

- Anchore, Inc. (2023). Scanning Container Images. Anchore Documentation. "To scan an image and see vulnerabilities from all layers, not just the final squashed layer, use the --scope all-layers argument: grype --scope all-layers".

On Debian/Ubuntu systems the ModSecurity 2 module for Apache is provided by the package libapache2-mod-security2.

Installing it together with all dependencies is achieved with:

sudo apt install libapache2-mod-security2 -y

where the “-y” non-interactive flag automatically accepts the prompt.

B. “-x” is not a valid apt flag; installation aborts.

C. “-w” is an invalid flag for apt; command fails.

D. “-z” is not recognised by apt; installation stops.

1. Debian Security Guide, Chapter 9.3 “Installing ModSecurity”, Example command.

2. Ubuntu Server Guide 22.04 LTS, Section “Web Server Hardening”, para 4 (“sudo apt install libapache2-mod-security2 -y”).

3. OWASP ModSecurity Core Rule Set Project, Installation wiki, Step 1 (“libapache2-mod-security2 package via apt”).

ThreatPlaybook is a DevSecOps framework with a command-line interface (CLI) for configuration and operation. The official documentation specifies that the command to configure the CLI is threatplaybook configure. This command requires parameters for the user's email, the host information (IP address or domain name) of the ThreatPlaybook server, and the port number. The correct flags for these parameters are -e for email, -h for host, and -p for port, making the complete command ThreatPlaybook configure -e -h -p .

A. This option uses the shorthand playbook instead of the full command name ThreatPlaybook, which may not be a valid alias. The full name is the documented command.

B. The -u flag is incorrect for specifying the host information. The correct flag, as per the tool's documentation, is -h.

D. This option uses both an incorrect command shorthand (playbook) and an incorrect flag for the host (-u instead of -h).

- ThreatPlaybook Official Documentation (GitHub Repository), README.md or docs section. The setup and configuration instructions detail the CLI commands. The "Configure CLI" section shows the command: threatplaybook configure --email --host --port . The short flags are -e, -h, and -p. (github.com/we45/ThreatPlaybook/blob/master/docs/clidoc.md)

When changes are committed to a source repository configured in an AWS CodePipeline, an Amazon CloudWatch Event (now part of Amazon EventBridge) is generated. AWS CodePipeline uses a CloudWatch Events rule to detect these source changes (e.g., a push to an AWS CodeCommit repository). This event acts as a trigger, automatically starting a new execution of the pipeline. This event-driven mechanism ensures that the CI/CD process is initiated immediately upon a code change, facilitating continuous integration and delivery.

A. Cloud Config is used for auditing and evaluating AWS resource configurations, not for triggering pipelines from code commits.

B. BinSkim is a static analysis tool for binaries; it is a tool used within a pipeline, not an event that triggers it.

D. Security Hub aggregates security findings from various AWS services; it does not trigger pipeline executions based on repository changes.

1. AWS Documentation. (2023). Start a pipeline execution in CodePipeline. AWS CodePipeline User Guide. Retrieved from https://docs.aws.amazon.com/codepipeline/latest/userguide/pipelines-start.html. (See the section "Start a pipeline automatically with source code changes," which states, "We recommend you use Amazon CloudWatch Events to detect the latest change and then start your pipeline.")

2. AWS Documentation. (2023). Tutorial: Create a simple pipeline (CodeCommit repository). AWS CodePipeline User Guide. Retrieved from https://docs.aws.amazon.com/codepipeline/latest/userguide/tutorials-simple-codecommit.html. (Step 2 mentions that for CodeCommit, "a CloudWatch Events rule is created to detect changes and start the pipeline.")

In the described AWS CI/CD pipeline, AWS CodeBuild is the service responsible for executing build and test commands. The pipeline is triggered and orchestrated by AWS CodePipeline, but the actual execution of the Snyk Command Line Interface (CLI) to scan the code occurs within a CodeBuild environment. CodeBuild runs the commands defined in a buildspec.yml file, which would include snyk test and snyk monitor. These CLI commands then interact with the Snyk service, sending scan results to the Snyk UI.

A. AWS CodeDeploy is a service for automating application deployments to various compute services. It is used after the build and test phase.

B. AWS CodeCommit is the source control repository. It stores the code and triggers the pipeline but does not execute build commands.

C. AWS CodePipeline is the orchestration service that defines the workflow stages (e.g., Source, Build, Deploy) but relies on other services like CodeBuild to perform the actions.

1. Snyk. (n.d.). Integrate with AWS CodePipeline. Snyk User Documentation. Retrieved from https://docs.snyk.io/integrations/ci-cd-integrations/aws-codepipeline-integration. The official integration guide shows a buildspec.yml file for AWS CodeBuild that contains the Snyk CLI commands.

2. Amazon Web Services. (n.d.). What Is AWS CodeBuild? AWS CodeBuild Documentation. Retrieved from https://docs.aws.amazon.com/codebuild/latest/userguide/welcome.html.

"AWS CodeBuild is a fully managed continuous integration service that compiles source code, runs tests, and produces software packages that are ready to deploy."

"Change lead time" (or Lead Time for Changes) is a key DevOps metric that measures the time from a code commit to that code successfully running in production. This metric, popularized by the DevOps Research and Assessment (DORA) team and adopted by agencies like the GSA, directly assesses the efficiency of the entire delivery pipeline. It encompasses the time spent in development, automated testing, security checks, and deployment. A short change lead time indicates a highly efficient and automated pipeline, enabling rapid delivery of both new features and bug fixes.

A: Mean time to recovery (MTTR) measures how quickly service can be restored after a production failure, not development speed.

B: Change volume measures the number of deployments or changes, not the time it takes to deliver a single change.

C: Time to value is a broader business metric measuring the time from idea conception to customer realization of value.

U.S. General Services Administration (GSA). (n.d.). "DevOps Metrics." Tech at GSA. Retrieved from https://tech.gsa.gov/guides/devopsmetrics/. (This official GSA guide lists "Lead time for changes" as a key metric, defining it as the time from commit to production).

Forsgren, N., Humble, J., & Kim, G. (2018). Accelerate: The Science of Lean Software and DevOps. IT Revolution Press. Chapter 2, "Measuring Performance". (This foundational book defines Lead Time for Changes as a core metric of software delivery performance).