A development team is building a public-facing web application that accepts user comments and displays them on a community page. During a security review, the team wants to prevent stored XSS attacks. Which combination of practices should the team implement?

Store comments as base64-encoded strings and decode them when displaying.

Validate input to allow only alphanumeric characters and encode all output before rendering.

Use a web application firewall (WAF) to block malicious payloads and disable client-side scripting in the browser.

Encode all input before storing it in the database and rely on the database to handle rendering.

What is the primary goal of threat modeling in application development?

To write unit tests for all code modules

To deploy the application to production as quickly as possible

To identify and assess potential threats to guide secure design decisions

To create user documentation for the application

What is a key consideration when logging security events?

Store logs in plaintext to ensure they are readable by anyone

Log all user input exactly as entered for forensic analysis

Disable logging to reduce storage costs

Avoid logging sensitive information such as passwords or session tokens

What is the main purpose of a secure code review?

To test the application's user interface

To identify and fix security vulnerabilities in the source code

To document the code for future maintenance

To optimize the code for better performance

Which practice is most directly aimed at preventing injection attacks such as SQL injection and command injection?

Using strong encryption for data at rest

Validating and sanitizing all user inputs before processing

Implementing role-based access control for all users

Encoding output data before rendering it in a browser

EC-CouncilCloud Security Essentials

Domain 5Objective 3

Secure Coding Practices CSE Practice Questions (Page 1)

Part of the Application Security in the Cloud domain, which makes up ~16% of our current practice bank.

60questions here

12free pages

12concepts

Questions 1–5

1application · medium
A development team is building a public-facing web application that accepts user comments and displays them on a community page. During a security review, the team wants to prevent stored XSS attacks. Which combination of practices should the team implement?
Select an answer first
2foundation · easy
What is the primary goal of threat modeling in application development?
Select an answer first
3foundation · easy
What is a key consideration when logging security events?
Select an answer first
4foundation · easy
What is the main purpose of a secure code review?
Select an answer first
5foundation · easy
Which practice is most directly aimed at preventing injection attacks such as SQL injection and command injection?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSE” is a trademark of its owner, used for identification only.