Which of the following is a common practice when integrating security testing into CI/CD?

Running security scans only on a nightly basis

Disabling security scans to speed up the pipeline

Running security scans only in production

Failing the build when critical vulnerabilities are found

Which threat modeling technique involves drawing a data flow diagram and then identifying threats using a structured approach such as STRIDE?

PASTA (Process for Attack Simulation and Threat Analysis)

What is the main goal of a security-focused code review?

To ensure that all code is written by a single developer

To check code for style consistency and naming conventions

To identify and fix security vulnerabilities before the code is deployed

To measure the performance of the application under load

A team is building a payment processing system. During threat modeling, they identify a threat where an attacker could modify the amount of a transaction. Which mitigation is most effective?

Digitally sign the transaction data using a server-side private key and verify the signature on the server before processing.

Validate the transaction amount on the client side before submission.

Store the transaction amount in a hidden form field.

Use HTTPS to encrypt the data in transit.

What is the difference between authentication and authorization?

Authorization verifies identity; authentication determines permissions

Authentication verifies identity; authorization determines what an authenticated user is allowed to do

Authentication is only used for external users, while authorization is for internal users

Authentication and authorization are the same concept

EC-CouncilDevSecOps Essentials

Domain 5Objective 2

Integrating Secure Coding in the Code Stage DSE Practice Questions (Page 2)

Part of the Implementing DevSecOps Testing and Threat Modeling domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

12concepts

12 Concepts in This Objective

Secure Coding Fundamentals
Threat Modeling in Code Stage
Static Application Security Testing (SAST)
Code Review for Security
Secure Coding Standards and Guidelines
Input Validation and Output Encoding
Authentication and Authorization Controls
Error Handling and Logging Security
Cryptography in Code
Dependency and Supply Chain Security
Security Testing Integration in CI/CD
Remediation and Fixing Vulnerabilities

Questions 6–10

6foundation · easy
Which of the following is a common practice when integrating security testing into CI/CD?
Select an answer first
7foundation · easy
Which threat modeling technique involves drawing a data flow diagram and then identifying threats using a structured approach such as STRIDE?
Select an answer first
8foundation · easy
What is the main goal of a security-focused code review?
Select an answer first
9expert · hard
A team is building a payment processing system. During threat modeling, they identify a threat where an attacker could modify the amount of a transaction. Which mitigation is most effective?
Select an answer first
10foundation · easy
What is the difference between authentication and authorization?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DSE” is a trademark of its owner, used for identification only.