A developer is writing error-handling code for a web application. The application currently returns detailed stack traces to the client when an exception occurs. Which change is most appropriate?

Return the stack trace to the client but only for authenticated administrators.

Redirect the client to the application's home page whenever an error occurs.

Log the full exception details server-side and return a generic error message to the client.

Suppress all error logging and return a generic message to the client.

A company has a monorepo with multiple services. They want to integrate SAST into the CI pipeline, but the SAST scan takes 30 minutes, which is too long for every commit. They also want to ensure that critical vulnerabilities are not missed. What is the best strategy?

Increase the build timeout to allow the full SAST scan on every commit.

Run the full SAST scan only on release candidates and rely on code reviews for other changes.

Run the full SAST scan only on the main branch after merge, and skip it on feature branches.

Run a fast, incremental SAST scan on changed files for each commit, and a full SAST scan on the main branch before release.

Which of the following is an example of proper input validation?

Using a regular expression to ensure a field contains only expected characters

Truncating all input to a fixed length without checking content

Accepting any input and relying on the database to handle it safely

Storing input in a hidden field for later processing

A development team uses a popular open-source library in their application. A new critical vulnerability is disclosed in that library. The team wants to address this in the code stage. Which action is most appropriate?

Update the library to the patched version and verify that the application still functions correctly.

Add a comment in the code noting the vulnerability and plan to update later.

Remove the library from the application and rewrite all functionality from scratch.

Disable the library's features that are affected by the vulnerability.

EC-CouncilDevSecOps Essentials

Domain 5Objective 2

Integrating Secure Coding in the Code Stage DSE Practice Questions (Page 1)

Part of the Implementing DevSecOps Testing and Threat Modeling domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

12concepts

12 Concepts in This Objective

Secure Coding Fundamentals
Threat Modeling in Code Stage
Static Application Security Testing (SAST)
Code Review for Security
Secure Coding Standards and Guidelines
Input Validation and Output Encoding
Authentication and Authorization Controls
Error Handling and Logging Security
Cryptography in Code
Dependency and Supply Chain Security
Security Testing Integration in CI/CD
Remediation and Fixing Vulnerabilities

Questions 1–5

1application · medium
A developer is writing error-handling code for a web application. The application currently returns detailed stack traces to the client when an exception occurs. Which change is most appropriate?
Select an answer first
2expert · hard
A company has a monorepo with multiple services. They want to integrate SAST into the CI pipeline, but the SAST scan takes 30 minutes, which is too long for every commit. They also want to ensure that critical vulnerabilities are not missed. What is the best strategy?
Select an answer first
3foundation · easy
Which of the following is an example of proper input validation?
Select an answer first
4application · medium
A development team uses a popular open-source library in their application. A new critical vulnerability is disclosed in that library. The team wants to address this in the code stage. Which action is most appropriate?
Select an answer first
5foundation · easy
In the STRIDE threat model, which category covers an attacker's ability to modify data or code without authorization?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DSE” is a trademark of its owner, used for identification only.