A security team wants to identify vulnerabilities in a web application before it goes live. They plan to run both static and dynamic analysis. Which combination of tools should they use?

A software composition analysis (SCA) tool and a network scanner.

A web application firewall (WAF) and a log analyzer.

A static application security testing (SAST) tool and a dynamic application security testing (DAST) tool.

A penetration testing tool and a vulnerability scanner.

A software company wants to embed security into its development process. Currently, security reviews happen only after the code is complete. The team wants to adopt a secure development lifecycle (SDL). Which change should they implement first?

Increase the number of penetration tests performed after release.

Include security requirements and threat modeling in the design phase of every project.

Purchase a static analysis tool and run it only on the final release candidate.

Train developers on secure coding practices and expect them to apply it without process changes.

An application's error handling currently returns detailed stack traces to users and logs full SQL queries. The security team wants to reduce information disclosure while maintaining the ability to debug issues. What should the team do?

Return the stack trace to users only when the request comes from an internal IP address.

Disable all error logging to prevent sensitive information from being stored.

Encrypt the error messages before sending them to the user.

Log full error details to a centralized logging system and show generic error messages to users.

What is the purpose of authorization checks in an application?

To verify that a user has permission to access a specific resource

To confirm the identity of a user

To encrypt data before transmission

EC-CouncilCloud Security Essentials

Domain 5Objective 3

Secure Coding Practices CSE Practice Questions (Page 11)

Part of the Application Security in the Cloud domain, which makes up ~16% of our current practice bank.

60questions here

12free pages

12concepts

Questions 51–55

51application · medium
A security team wants to identify vulnerabilities in a web application before it goes live. They plan to run both static and dynamic analysis. Which combination of tools should they use?
Select an answer first
52foundation · easy
Which security control is specifically designed to prevent cross-site scripting (XSS) attacks?
Select an answer first
53application · medium
A software company wants to embed security into its development process. Currently, security reviews happen only after the code is complete. The team wants to adopt a secure development lifecycle (SDL). Which change should they implement first?
Select an answer first
54application · medium
An application's error handling currently returns detailed stack traces to users and logs full SQL queries. The security team wants to reduce information disclosure while maintaining the ability to debug issues. What should the team do?
Select an answer first
55foundation · easy
What is the purpose of authorization checks in an application?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSE” is a trademark of its owner, used for identification only.