Which of the following is a typical output of a SAST tool?

A list of open ports on a production server

A graph of network connections between services

A report of potential vulnerabilities with the affected code locations

A record of all user login attempts

A developer needs to encrypt sensitive data before storing it in a database. They are considering using AES-256 in CBC mode with a fixed IV. A security review flags this. What is the best remediation?

Use a unique random IV for each encryption operation and store the IV alongside the ciphertext.

Use a hash of the plaintext as the IV.

Use a fixed IV but encrypt the IV with the same key.

Use AES-256 in ECB mode with a fixed key to avoid the need for an IV.

What is the purpose of a remediation plan for identified vulnerabilities?

To hide vulnerabilities from stakeholders

To automatically fix all vulnerabilities without developer involvement

To document how and when vulnerabilities will be fixed

To delay fixing vulnerabilities until after release

A developer is writing code that inserts user-supplied data into a SQL database. Which technique is the most effective at preventing SQL injection?

Validate the user input against a whitelist of allowed characters.

Use parameterized queries or prepared statements.

Escape single quotes in the user input before concatenating it into the query.

Use a stored procedure that dynamically builds the SQL query.

A team discovers that a widely used open-source library in their application has a known vulnerability. The patched version is not yet available. What is the best course of action?

Do nothing and wait for the official fix.

Apply a virtual patch or workaround, such as a WAF rule, while monitoring for the official fix.

Disable the library's features that are affected.

Remove the library immediately and rewrite the functionality.

EC-CouncilDevSecOps Essentials

Domain 5Objective 2

Integrating Secure Coding in the Code Stage DSE Practice Questions (Page 9)

Part of the Implementing DevSecOps Testing and Threat Modeling domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

12concepts

12 Concepts in This Objective

Secure Coding Fundamentals
Threat Modeling in Code Stage
Static Application Security Testing (SAST)
Code Review for Security
Secure Coding Standards and Guidelines
Input Validation and Output Encoding
Authentication and Authorization Controls
Error Handling and Logging Security
Cryptography in Code
Dependency and Supply Chain Security
Security Testing Integration in CI/CD
Remediation and Fixing Vulnerabilities

Questions 41–45

41foundation · easy
Which of the following is a typical output of a SAST tool?
Select an answer first
42expert · hard
A developer needs to encrypt sensitive data before storing it in a database. They are considering using AES-256 in CBC mode with a fixed IV. A security review flags this. What is the best remediation?
Select an answer first
43foundation · easy
What is the purpose of a remediation plan for identified vulnerabilities?
Select an answer first
44application · medium
A developer is writing code that inserts user-supplied data into a SQL database. Which technique is the most effective at preventing SQL injection?
Select an answer first
45expert · hard
A team discovers that a widely used open-source library in their application has a known vulnerability. The patched version is not yet available. What is the best course of action?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DSE” is a trademark of its owner, used for identification only.