During a code review, a developer notices that the application's error handler returns the full stack trace to the user and logs the user's password in plain text. What is the most appropriate remediation?

Log generic error messages to the user and detailed errors to a secure log with sensitive data redacted.

Return the stack trace only to authenticated administrators.

Remove all logging from the application to prevent sensitive data from being stored.

Encrypt the log file so that only the development team can read it.

A team has integrated a SAST tool into their CI pipeline. The tool reports a high number of false positives. What is the best way to handle this?

Automatically fail the build on every finding to force developers to fix them.

Tune the SAST tool's rules and baseline known false positives, while continuing to review new findings.

Disable the SAST tool because it is not useful.

Ignore all findings and rely on manual code reviews.

When prioritizing vulnerabilities for remediation, which factor should be considered first?

The severity of the vulnerability and its exploitability

The number of lines of code affected

The developer who wrote the code

A security-focused code review is being conducted for a new feature that handles user authentication. The reviewer notices that the code uses a custom password hashing algorithm. What should the reviewer recommend?

Store the password in plain text but restrict database access to the application only.

Add a salt to the custom algorithm to increase complexity.

Replace the custom algorithm with a well-established, memory-hard hashing function such as Argon2 or bcrypt.

Use a fast hashing algorithm like MD5 to improve performance.

What is the primary function of a Static Application Security Testing (SAST) tool?

To scan source code for known vulnerability patterns without executing the code

To monitor network traffic for malicious activity

To analyze running applications for vulnerabilities in real time

To perform penetration testing against a deployed application

EC-CouncilDevSecOps Essentials

Domain 5Objective 2

Integrating Secure Coding in the Code Stage DSE Practice Questions (Page 11)

Part of the Implementing DevSecOps Testing and Threat Modeling domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

12concepts

12 Concepts in This Objective

Secure Coding Fundamentals
Threat Modeling in Code Stage
Static Application Security Testing (SAST)
Code Review for Security
Secure Coding Standards and Guidelines
Input Validation and Output Encoding
Authentication and Authorization Controls
Error Handling and Logging Security
Cryptography in Code
Dependency and Supply Chain Security
Security Testing Integration in CI/CD
Remediation and Fixing Vulnerabilities

Questions 51–55

51application · medium
During a code review, a developer notices that the application's error handler returns the full stack trace to the user and logs the user's password in plain text. What is the most appropriate remediation?
Select an answer first
52application · medium
A team has integrated a SAST tool into their CI pipeline. The tool reports a high number of false positives. What is the best way to handle this?
Select an answer first
53foundation · easy
When prioritizing vulnerabilities for remediation, which factor should be considered first?
Select an answer first
54application · medium
A security-focused code review is being conducted for a new feature that handles user authentication. The reviewer notices that the code uses a custom password hashing algorithm. What should the reviewer recommend?
Select an answer first
55foundation · easy
What is the primary function of a Static Application Security Testing (SAST) tool?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DSE” is a trademark of its owner, used for identification only.