Which of the following is a key practice when conducting a security code review?

Focusing only on the functionality and ignoring security aspects

Reviewing code only after it has been deployed to production

Using a checklist of common vulnerabilities and secure coding practices

Having the same developer who wrote the code review it alone without any external input

During a security code review, a reviewer finds that a developer used a weak random number generator for generating password reset tokens. What should the reviewer recommend?

Use a fixed token for all users to simplify the implementation.

Use a hash of the user's password as the token.

Use a cryptographically secure random number generator (CSPRNG) for token generation.

Use the current timestamp as the token to ensure uniqueness.

What is the recommended way to protect data at rest in a database?

Using a simple hash of the data for storage

Using a strong encryption algorithm with proper key management

Storing data in plain text but restricting database access

Using reversible encoding like Base64

A web application uses a JWT stored in a cookie for authentication. A security review finds that the JWT is signed with HS256 using a hardcoded secret in the source code. The team wants to remediate this without breaking the current session flow. What should they do?

Switch to a public/private key algorithm (RS256) and store the private key in the repository for transparency.

Encode the secret in Base64 in the code so it is not readable as plain text.

Move the secret to a secure secrets manager and rotate it regularly, keeping HS256.

Remove the JWT and rely on the user's IP address for authentication.

EC-CouncilDevSecOps Essentials

Domain 5Objective 2

Integrating Secure Coding in the Code Stage DSE Practice Questions (Page 3)

Part of the Implementing DevSecOps Testing and Threat Modeling domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

12concepts

12 Concepts in This Objective

Secure Coding Fundamentals
Threat Modeling in Code Stage
Static Application Security Testing (SAST)
Code Review for Security
Secure Coding Standards and Guidelines
Input Validation and Output Encoding
Authentication and Authorization Controls
Error Handling and Logging Security
Cryptography in Code
Dependency and Supply Chain Security
Security Testing Integration in CI/CD
Remediation and Fixing Vulnerabilities

Questions 11–15

11foundation · easy
Which secure coding principle is primarily intended to reduce the impact of a security failure by limiting the privileges assigned to a process or user?
Select an answer first
12foundation · easy
Which of the following is a key practice when conducting a security code review?
Select an answer first
13application · medium
During a security code review, a reviewer finds that a developer used a weak random number generator for generating password reset tokens. What should the reviewer recommend?
Select an answer first
14foundation · easy
What is the recommended way to protect data at rest in a database?
Select an answer first
15application · medium
A web application uses a JWT stored in a cookie for authentication. A security review finds that the JWT is signed with HS256 using a hardcoded secret in the source code. The team wants to remediate this without breaking the current session flow. What should they do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DSE” is a trademark of its owner, used for identification only.