Why should error messages avoid revealing detailed internal information?

To prevent attackers from gaining insights into the system's internals

To make debugging easier for developers

To reduce the size of the error message

To comply with performance best practices

A web application has a role-based access control (RBAC) system. A developer is implementing a function that allows users to view their own profile. Which check is necessary?

Verify that the user is logged in, but do not check the profile ID.

Rely on the front-end to hide the profile link from unauthorized users.

Verify that the authenticated user's ID matches the profile ID being requested.

Check that the user has the 'admin' role before allowing access.

A CI/CD pipeline builds a Java application that pulls dependencies from a public repository. A developer notices that a transitive dependency has a known critical vulnerability. The team wants to prevent this from reaching production. What is the best action?

Ignore the vulnerability because it is only in a transitive dependency and not directly called.

Add a software composition analysis (SCA) step that fails the build if any dependency has a critical vulnerability.

Manually update the transitive dependency in the source code and commit the change.

Remove the dependency from the build and rewrite the functionality from scratch.

Which of the following is a secure practice for implementing authentication?

Storing passwords in plain text in the database

Using a strong hashing algorithm with a unique salt for each password

Sending passwords in URLs for easy tracking

Allowing unlimited login attempts to avoid user frustration

EC-CouncilDevSecOps Essentials

Domain 5Objective 2

Integrating Secure Coding in the Code Stage DSE Practice Questions (Page 6)

Part of the Implementing DevSecOps Testing and Threat Modeling domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

12concepts

12 Concepts in This Objective

Secure Coding Fundamentals
Threat Modeling in Code Stage
Static Application Security Testing (SAST)
Code Review for Security
Secure Coding Standards and Guidelines
Input Validation and Output Encoding
Authentication and Authorization Controls
Error Handling and Logging Security
Cryptography in Code
Dependency and Supply Chain Security
Security Testing Integration in CI/CD
Remediation and Fixing Vulnerabilities

Questions 26–30

26foundation · easy
Why should error messages avoid revealing detailed internal information?
Select an answer first
27application · medium
A web application has a role-based access control (RBAC) system. A developer is implementing a function that allows users to view their own profile. Which check is necessary?
Select an answer first
28application · medium
A CI/CD pipeline builds a Java application that pulls dependencies from a public repository. A developer notices that a transitive dependency has a known critical vulnerability. The team wants to prevent this from reaching production. What is the best action?
Select an answer first
29foundation · easy
Which of the following is an example of a widely adopted secure coding standard?
Select an answer first
30foundation · easy
Which of the following is a secure practice for implementing authentication?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DSE” is a trademark of its owner, used for identification only.