A company's CI/CD pipeline builds a container image for a web application. The security team wants to integrate security testing early in the pipeline. Which action should they take?

Run a dynamic application security test (DAST) after the image is deployed to production.

Use a container image scanner only, since it covers all application vulnerabilities.

Perform a manual code review only after the image is published to the registry.

Add a static application security testing (SAST) step and a dependency scanner to the pipeline before the image is built.

What is the primary purpose of session management in a web application?

To maintain a secure state for authenticated users across requests

To permanently keep sessions active to avoid re-authentication

To allow multiple users to share the same session

To store user passwords in plaintext for quick verification

What is the purpose of secure configuration in cloud applications?

To use default passwords for all services to simplify management

To store configuration files in publicly accessible storage for easy updates

To disable unnecessary features and set secure defaults to reduce attack surface

To enable all available features to maximize functionality

What is the main goal of integrating security into the software development lifecycle (SDLC)?

To identify and address security issues early in the development process

To speed up the development process by skipping security reviews

To ensure that only the security team is responsible for security

To eliminate the need for security testing

A company is deploying a containerized web application to a cloud platform. The security team wants to minimize the attack surface by disabling unnecessary features and setting secure defaults. Which action should the team take?

Set environment variables to enable debug mode for easier troubleshooting.

Run the container as a non-root user and remove any unused packages and services from the image.

Use the latest version of the base image without reviewing its contents.

Expose all container ports to the public internet to simplify connectivity.

EC-CouncilCloud Security Essentials

Domain 5Objective 3

Secure Coding Practices CSE Practice Questions (Page 2)

Part of the Application Security in the Cloud domain, which makes up ~16% of our current practice bank.

60questions here

12free pages

12concepts

Questions 6–10

6application · medium
A company's CI/CD pipeline builds a container image for a web application. The security team wants to integrate security testing early in the pipeline. Which action should they take?
Select an answer first
7foundation · easy
What is the primary purpose of session management in a web application?
Select an answer first
8foundation · easy
What is the purpose of secure configuration in cloud applications?
Select an answer first
9foundation · easy
What is the main goal of integrating security into the software development lifecycle (SDLC)?
Select an answer first
10application · medium
A company is deploying a containerized web application to a cloud platform. The security team wants to minimize the attack surface by disabling unnecessary features and setting secure defaults. Which action should the team take?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSE” is a trademark of its owner, used for identification only.