A development team is using a third-party component library that has a known vulnerability. The team is unsure whether to update the library because it may break existing functionality. Which approach best balances security and stability?

Update the library in a staging environment, run regression tests, and then deploy if tests pass

Immediately update the library to the latest version without testing

Keep the vulnerable version and rely on a WAF to block attacks

Disable the library's features that are vulnerable

A developer is writing code to handle user authentication. To mitigate the OWASP Top 10 risk of identification and authentication failures, which approach should be taken during development?

Store passwords in plain text to simplify debugging

Use a single shared password for all users to reduce complexity

Implement multi-factor authentication (MFA) for all users

Allow unlimited login attempts to improve user experience

During the design phase of a new web application, the team wants to reduce the risk of injection attacks. Which practice is most effective to incorporate into the development lifecycle?

Using client-side input validation only

Adding a web application firewall (WAF) after deployment

Using parameterized queries for all database interactions

Disabling error messages in production

A team is developing a web application that handles user authentication. They are implementing a 'remember me' feature that stores a cookie on the user's browser. The security lead warns that the current implementation is vulnerable to session hijacking. Which combination of controls best mitigates the risk?

Store the session token in a JavaScript variable and clear it on page unload

Use a long-lived cookie with no expiration and rely on the browser's incognito mode

Set the cookie with Secure and HttpOnly flags, and implement session expiration on the server

Encode the session token using Base64 and include the user's IP address in the token

EC-CouncilDevSecOps Essentials

Domain 1Objective 4

Common Application Security Risks and OWASP Top 10 DSE Practice Questions (Page 3)

Part of the Application Development and Security Fundamentals domain, which makes up ~20% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 2–3 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

4concepts

Questions 11–15

11application · medium
A development team is using a third-party component library that has a known vulnerability. The team is unsure whether to update the library because it may break existing functionality. Which approach best balances security and stability?
Select an answer first
12foundation · easy
A developer is writing code to handle user authentication. To mitigate the OWASP Top 10 risk of identification and authentication failures, which approach should be taken during development?
Select an answer first
13foundation · easy
During the design phase of a new web application, the team wants to reduce the risk of injection attacks. Which practice is most effective to incorporate into the development lifecycle?
Select an answer first
14application · medium
A team is developing a web application that handles user authentication. They are implementing a 'remember me' feature that stores a cookie on the user's browser. The security lead warns that the current implementation is vulnerable to session hijacking. Which combination of controls best mitigates the risk?
Select an answer first
15foundation · easy
Which OWASP Top 10 category describes a risk where an attacker can execute arbitrary commands or queries by sending crafted data to an interpreter?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DSE” is a trademark of its owner, used for identification only.

Common Application Security Risks and OWASP Top 10 DSE Practice Questions (Page 3)

Questions 11–15

A development team is using a third-party component library that has a known vulnerability. The team is unsure whether to update the library because it may break existing functionality. Which approach best balances security and stability?

A developer is writing code to handle user authentication. To mitigate the OWASP Top 10 risk of identification and authentication failures, which approach should be taken during development?

During the design phase of a new web application, the team wants to reduce the risk of injection attacks. Which practice is most effective to incorporate into the development lifecycle?

Which OWASP Top 10 category describes a risk where an attacker can execute arbitrary commands or queries by sending crafted data to an interpreter?

Keep studying — Application Development and Security Fundamentals