A company is adopting a DevSecOps culture and wants to integrate security into the software development lifecycle. They currently perform a security review only after the code is fully developed. Which change best reflects a secure SDLC integration?

Rely solely on developer training to avoid vulnerabilities

Incorporate threat modeling during design and automated security testing in CI/CD pipelines

Perform a single penetration test just before production release

Deploy a WAF in production to fix all security issues

When storing user passwords, which of the following is the most secure approach?

Encrypting passwords with a reversible algorithm

Hashing passwords with a strong, salted hash algorithm

Using a simple MD5 hash without salt

A developer is writing a function that builds a SQL query by concatenating user input directly into the statement. The code review team flags this as a SQL injection risk. Which secure coding practice should the developer apply to prevent this vulnerability?

Validate input with a blocklist

Use a stored procedure without parameters

Encode all output with HTML entities

Which of the following activities is typically performed during the deployment phase of a secure SDLC?

Conducting a security code review

Configuring the production environment securely

EC-CouncilDevSecOps Essentials

Domain 1Objective 5

Secure Design Principles, Threat Modeling, and Secure Coding DSE Practice Questions (Page 10)

Part of the Application Development and Security Fundamentals domain, which makes up ~20% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 2–3 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

10concepts

10 Concepts in This Objective

Secure Design Principles
Threat Modeling Process
Threat Identification Techniques
Risk Assessment and Mitigation
Secure Coding Fundamentals
Input Validation and Output Encoding
Authentication and Authorization Controls
Error Handling and Logging
Cryptography in Application Security
Secure Development Lifecycle Integration

Questions 46–50

46application · medium
A company is adopting a DevSecOps culture and wants to integrate security into the software development lifecycle. They currently perform a security review only after the code is fully developed. Which change best reflects a secure SDLC integration?
Select an answer first
47foundation · easy
When storing user passwords, which of the following is the most secure approach?
Select an answer first
48foundation · easy
In which phase of the secure software development lifecycle (SDLC) should security requirements such as authentication and encryption be defined?
Select an answer first
49application · medium
A developer is writing a function that builds a SQL query by concatenating user input directly into the statement. The code review team flags this as a SQL injection risk. Which secure coding practice should the developer apply to prevent this vulnerability?
Select an answer first
50foundation · easy
Which of the following activities is typically performed during the deployment phase of a secure SDLC?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DSE” is a trademark of its owner, used for identification only.