Which of the following is a secure error handling practice?

Ignoring all errors to keep the application running

Displaying generic error messages to users while logging detailed errors internally

Showing full stack traces to users to help them understand the error

Logging passwords and credit card numbers to aid debugging

Which type of security testing is most effective at identifying runtime vulnerabilities such as authentication bypasses?

Static application security testing (SAST)

Dynamic application security testing (DAST)

A cloud application stores sensitive user data in a database. The team wants to protect the data at rest and in transit, but also needs to perform searches on the data. They are considering encrypting the data with a cloud KMS. Which consideration is most important?

Encrypt all data with the same key to simplify key management.

Use only TLS for data in transit and rely on the cloud provider's default database encryption.

Encrypt the entire database with a single key stored in the application code.

Use envelope encryption with a customer-managed key in the cloud KMS, and ensure the application uses TLS for all data in transit.

What is the primary purpose of input validation in secure coding?

To log all user actions for auditing purposes

To encrypt user data before it is stored in the database

To ensure that only properly formatted and expected data is accepted

To authenticate users before they access the application

A development team is about to release a major update to a cloud application. The security team wants to catch vulnerabilities before production deployment. Which approach is most effective?

Deploy to production and monitor for attacks.

Perform a manual code review focusing on authentication, input validation, and cryptographic implementations.

Run a static analysis tool and fix all reported issues without manual review.

Ask the developers to self-review their own code.

EC-CouncilCloud Security Essentials

Domain 5Objective 3

Secure Coding Practices CSE Practice Questions (Page 5)

Part of the Application Security in the Cloud domain, which makes up ~16% of our current practice bank.

60questions here

12free pages

12concepts

Questions 21–25

21foundation · easy
Which of the following is a secure error handling practice?
Select an answer first
22foundation · easy
Which type of security testing is most effective at identifying runtime vulnerabilities such as authentication bypasses?
Select an answer first
23expert · hard
A cloud application stores sensitive user data in a database. The team wants to protect the data at rest and in transit, but also needs to perform searches on the data. They are considering encrypting the data with a cloud KMS. Which consideration is most important?
Select an answer first
24foundation · easy
What is the primary purpose of input validation in secure coding?
Select an answer first
25application · medium
A development team is about to release a major update to a cloud application. The security team wants to catch vulnerabilities before production deployment. Which approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSE” is a trademark of its owner, used for identification only.