312-97 Exam Questions 2026 – Practice Test with Answers

Explanation:
In Go-based tool installation, the standard method to download, compile, and install a Go package is using the go get command followed by the repository import path. Since Matt has already ensured that Go version 1.8 or later is installed and that $GOPATH/bin is included in the system PATH, running go get github.com /michenriksen/gitrob will fetch the GitRob source code, build the binary, and place it in the appropriate bin directory.
Options B, C, and D are invalid because go get does not accept multiple positional arguments in that manner, and go git is not a valid Go command. Installing GitRob during the Code stage enables DevSecOps teams to scan repositories for accidentally committed credentials, API keys, and other sensitive information, helping prevent data leakage from public repositories.

Explanation:
The pytm framework generates threat models that can be visualized using PlantUML diagrams. To create a sequence diagram, the --seq option is used with the model file, and the output is piped to the PlantUML processor. The correct command must reference the correct Java system property -Djava.awt.headless=true, which allows diagram rendering in environments without a graphical interface, such as CI/CD pipelines. Additionally, the correct jar file name is plantuml.jar.
Options using lowercase -d instead of uppercase -D are invalid, and commands referencing plantum.jar are incorrect due to a misspelled jar name. Generating sequence diagrams during the Plan stage helps DevSecOps teams visualize data flows, understand attacker paths, and identify security threats early in the application design phase.

Explanation:
Build-time checks are designed to enforce security gates within the CI/CD pipeline. When critical vulnerabilities such as SQL injection and cross-site scripting (XSS) are detected during this stage, the correct and expected behavior is to fail the build. Stopping the build process prevents insecure code from progressing to later stages such as testing, deployment, or production. Ignoring issues or merely sending alerts while continuing the pipeline undermines the purpose of shift-left security. Alerts to SIEM systems and issue trackers are typically supplementary actions, but the primary enforcement mechanism at build time is to block the pipeline when severity thresholds are exceeded. This approach reduces remediation costs, limits exposure, and ensures that only secure artifacts move forward in the DevSecOps lifecycle.

Explanation:
Keywhiz CLI requires authentication before secrets can be added. The correct process involves logging in using the --devTrustStore option and authenticating as an administrator using the --admin flag. Once authenticated, the add secret command is used with input redirection to securely store the secret.
Options that use incorrect flag names, incorrect casing, or invalid trust store identifiers do not follow Keywhiz CLI syntax. Adding secrets through Keywhiz instead of embedding them in code supports secure secret distribution and management, which is a fundamental aspect of DevSecOps culture. This approach ensures secrets remain protected, auditable, and available even during outages.

Explanation:
The practices described―access management, defense in depth, minimizing third-party dependencies, and securing weak links―are all architectural and design-level decisions. These controls are not merely coding techniques or configuration defaults but reflect security being embedded into the system’s blueprint from the earliest stages. This aligns directly with the Secure by Design principle, which emphasizes proactively designing systems to resist attacks rather than reacting to vulnerabilities later. Secure by implementation focuses on writing correct and safe code, secure by default focuses on initial configuration settings, and secure by communication addresses trust and confidentiality in communication channels. Orange International’s approach demonstrates a holistic security mindset that anticipates threats and integrates protective measures throughout the system architecture, making Secure by Design the correct choice.