ECDE study guide
ECDE · Work through your exam, one topic at a time.
The EC-Council Certified DevSecOps Engineer (ECDE) is a vendor certification, exam code 312-97, aimed at people who build or secure automated software delivery pipelines. EC-Council positions it for DevOps engineers, software engineers and testers, application security professionals, IT security professionals, and cyber security engineers or analysts, plus anyone with prior application security knowledge who wants to move into a DevSecOps role. The ECDE study guide has 7 sections and about 3,172 words.
01Understanding DevOps Culture
This domain tests whether you can separate cultural change from toolchain adoption. Exam items ask you to identify the Three Ways, the CALMS framework, blameless postmortems, the Westrum typology, the DORA four keys, and Conway's Law, then apply them to a scenario and pick the systemic answer over the blaming answer.
441 words, about 2 min02Introduction to DevSecOps
This domain covers the definition and mechanics of DevSecOps: what actually changes when security is embedded in a delivery pipeline rather than bolted on at the end. Expect questions on shift-left economics, security as code, shared ownership, and the security team's changed role.
441 words, about 2 min03DevSecOps Pipeline – Plan Stage
The Plan stage is where security is cheapest to apply and easiest to skip. This domain tests threat modelling, security requirements, abuse cases, risk treatment and compliance scoping performed before code exists.
445 words, about 2 min04DevSecOps Pipeline – Code Stage
The Code stage covers what happens between a developer's editor and the shared repository. This domain tests secure coding practice, peer review, secret prevention, source control hardening and the first automated checks.
443 words, about 2 min05DevSecOps Pipeline – Build and Test Stage
This domain covers the CI engine itself and the automated test gates attached to it. Questions focus on pipeline hardening, the scan types and what each can and cannot see, artifact integrity, and how to set gates that teams respect.
468 words, about 2 min06DevSecOps Pipeline – Release and Deploy Stage
This domain covers getting a verified artifact into an environment safely: deployment strategy, infrastructure as code, policy enforcement, secret delivery and supply chain provenance. Progressive delivery : canary releases shift a small percentage of traffic, compare error rate and latency against baseline, then widen or roll back automatically.
470 words, about 2 min07DevSecOps Pipeline – Operate and Monitor Stage
The final domain covers runtime detection, incident response and the feedback loop that returns production evidence into planning. Exam items test observability, runtime security tooling, IR phases and vulnerability SLAs.
464 words, about 2 min