A web application accepts a user's date of birth in a form field. The application stores the value in a database and later displays it on a profile page. Which combination of controls is most effective in preventing both SQL injection and stored XSS?

Use a stored procedure to insert the data and disable JavaScript in the browser.

Use input validation to ensure the date is in a valid format and store it as a string.

Use parameterized queries for database access and HTML-encode the value when displaying it.

Use an ORM to handle database access and rely on the ORM to automatically encode output.

A developer is writing a C++ function that copies user input into a fixed-size buffer. The code does not check the length of the input before copying. Which secure coding practice should be applied to prevent a buffer overflow?

Use the gets() function to read input because it is simpler.

Increase the buffer size to a very large value to accommodate any input.

Use a safer function like strncpy with an explicit length limit.

Disable compiler warnings for the function.

EC-CouncilDevSecOps Essentials

Domain 1Objective 5

Secure Design Principles, Threat Modeling, and Secure Coding DSE Practice Questions (Page 4)

Part of the Application Development and Security Fundamentals domain, which makes up ~20% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 2–3 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

10concepts

10 Concepts in This Objective

Secure Design Principles
Threat Modeling Process
Threat Identification Techniques
Risk Assessment and Mitigation
Secure Coding Fundamentals
Input Validation and Output Encoding
Authentication and Authorization Controls
Error Handling and Logging
Cryptography in Application Security
Secure Development Lifecycle Integration

Questions 16–20

16foundation · easy
A team identifies a high-likelihood, high-impact threat and decides to implement a web application firewall (WAF) and input validation to reduce the risk. Which risk treatment strategy are they applying?
Select an answer first
17application · medium
A web application accepts a user's date of birth in a form field. The application stores the value in a database and later displays it on a profile page. Which combination of controls is most effective in preventing both SQL injection and stored XSS?
Select an answer first
18application · medium
A web application displays user-generated comments on a public page. The application currently outputs the comments without any sanitization. Which control is most directly effective in preventing stored cross-site scripting (XSS) attacks?
Select an answer first
19application · medium
A developer is writing a C++ function that copies user input into a fixed-size buffer. The code does not check the length of the input before copying. Which secure coding practice should be applied to prevent a buffer overflow?
Select an answer first
20foundation · easy
In a role-based access control (RBAC) system, what determines what resources a user can access?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DSE” is a trademark of its owner, used for identification only.

Secure Design Principles, Threat Modeling, and Secure Coding DSE Practice Questions (Page 4)

Questions 16–20

A team identifies a high-likelihood, high-impact threat and decides to implement a web application firewall (WAF) and input validation to reduce the risk. Which risk treatment strategy are they applying?

A web application accepts a user's date of birth in a form field. The application stores the value in a database and later displays it on a profile page. Which combination of controls is most effective in preventing both SQL injection and stored XSS?

A web application displays user-generated comments on a public page. The application currently outputs the comments without any sanitization. Which control is most directly effective in preventing stored cross-site scripting (XSS) attacks?

A developer is writing a C++ function that copies user input into a fixed-size buffer. The code does not check the length of the input before copying. Which secure coding practice should be applied to prevent a buffer overflow?

In a role-based access control (RBAC) system, what determines what resources a user can access?

Keep studying — Application Development and Security Fundamentals