A company is developing a microservices-based application. Each microservice has its own database. The security team wants to ensure that sensitive data is protected across all services. They are considering two options: (1) encrypt data at rest in each database, and (2) implement a centralized key management service (KMS). Which approach is more effective and why?

Encrypt data at rest in each database without a centralized KMS

Implement a centralized KMS and use it to encrypt data at rest in each database

Rely on network encryption (TLS) to protect data at rest

Use application-level encryption with hardcoded keys

A development team is using a CI/CD pipeline to build and deploy a web application. The security team wants to integrate OWASP Top 10 checks early in the pipeline. Which approach best aligns with the 'shift-left' principle?

Use a WAF in production to block attacks instead of fixing code

Conduct a manual code review once before the final release

Perform a penetration test only after the application is deployed to production

Run a SAST tool after every commit and fail the build on critical findings

A company is developing a web application that handles user-generated content. The security team wants to prevent XSS attacks. They are considering two approaches: (1) sanitize user input on the server side, and (2) encode output on the client side. Which approach is more effective and why?

Use a Content Security Policy (CSP) instead of sanitization or encoding

Sanitize user input on the server side because it is the only way to prevent XSS

Use both server-side input sanitization and output encoding

Encode output on the client side because it is more efficient

A company is migrating a legacy application to the cloud. The application uses XML-based APIs. The security team is concerned about XXE (XML External Entity) attacks. Which OWASP Top 10 category is most relevant, and what is the best mitigation?

Broken Access Control; restrict network access from the application server

Sensitive Data Exposure; encrypt all XML payloads in transit

Security Misconfiguration; enable secure XML parsing mode in the web server

Injection; disable external entity processing in the XML parser

Which OWASP Top 10 category involves a web application failing to properly restrict what an authenticated user can do, such as accessing another user's data by modifying a URL parameter?

Cross-Site Request Forgery (CSRF)

Identification and Authentication Failures

EC-CouncilDevSecOps Essentials

Domain 1Objective 4

Common Application Security Risks and OWASP Top 10 DSE Practice Questions (Page 4)

Part of the Application Development and Security Fundamentals domain, which makes up ~20% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 2–3 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

4concepts

Questions 16–20

16expert · hard
A company is developing a microservices-based application. Each microservice has its own database. The security team wants to ensure that sensitive data is protected across all services. They are considering two options: (1) encrypt data at rest in each database, and (2) implement a centralized key management service (KMS). Which approach is more effective and why?
Select an answer first
17application · medium
A development team is using a CI/CD pipeline to build and deploy a web application. The security team wants to integrate OWASP Top 10 checks early in the pipeline. Which approach best aligns with the 'shift-left' principle?
Select an answer first
18expert · hard
A company is developing a web application that handles user-generated content. The security team wants to prevent XSS attacks. They are considering two approaches: (1) sanitize user input on the server side, and (2) encode output on the client side. Which approach is more effective and why?
Select an answer first
19application · medium
A company is migrating a legacy application to the cloud. The application uses XML-based APIs. The security team is concerned about XXE (XML External Entity) attacks. Which OWASP Top 10 category is most relevant, and what is the best mitigation?
Select an answer first
20foundation · easy
Which OWASP Top 10 category involves a web application failing to properly restrict what an authenticated user can do, such as accessing another user's data by modifying a URL parameter?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DSE” is a trademark of its owner, used for identification only.