A development team is implementing authentication for a new application. They want to store user passwords securely. Which approach is the most secure practice for password storage?

Hash passwords with MD5 and a global salt

Encrypt passwords with a symmetric key stored in the application code

Hash passwords with a strong adaptive algorithm and a unique salt per user

Store passwords in plaintext for easy recovery

A security team is prioritizing threats identified for a new online banking system. They have identified two threats: Threat A has a high likelihood but low impact, and Threat B has a low likelihood but high impact. The team has limited resources and must choose which to mitigate first. Which approach is most appropriate?

Mitigate both threats simultaneously with equal effort

Calculate the risk score (likelihood × impact) for both and prioritize the higher score

Mitigate Threat B first because the impact is high

Mitigate Threat A first because it is more likely to occur

A web application displays user-generated comments on a page. To prevent cross-site scripting (XSS) attacks, what should the application do before rendering the comments?

Validate the input with a blacklist

Disable JavaScript in the browser

EC-CouncilDevSecOps Essentials

Domain 1Objective 5

Secure Design Principles, Threat Modeling, and Secure Coding DSE Practice Questions (Page 6)

Part of the Application Development and Security Fundamentals domain, which makes up ~20% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 2–3 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

10concepts

10 Concepts in This Objective

Secure Design Principles
Threat Modeling Process
Threat Identification Techniques
Risk Assessment and Mitigation
Secure Coding Fundamentals
Input Validation and Output Encoding
Authentication and Authorization Controls
Error Handling and Logging
Cryptography in Application Security
Secure Development Lifecycle Integration

Questions 26–30

26application · medium
A development team is implementing authentication for a new application. They want to store user passwords securely. Which approach is the most secure practice for password storage?
Select an answer first
27expert · medium
A security team is prioritizing threats identified for a new online banking system. They have identified two threats: Threat A has a high likelihood but low impact, and Threat B has a low likelihood but high impact. The team has limited resources and must choose which to mitigate first. Which approach is most appropriate?
Select an answer first
28foundation · easy
During a threat modeling exercise, the team lists all the ways an attacker could interact with the system, such as the login page, API endpoints, and file upload functionality. Which element of the threat modeling process are they identifying?
Select an answer first
29foundation · easy
A web application displays user-generated comments on a page. To prevent cross-site scripting (XSS) attacks, what should the application do before rendering the comments?
Select an answer first
30foundation · easy
A developer is writing code that copies user input into a fixed-size buffer without checking the length. Which common coding vulnerability is the developer at risk of introducing?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DSE” is a trademark of its owner, used for identification only.

Secure Design Principles, Threat Modeling, and Secure Coding DSE Practice Questions (Page 6)

Questions 26–30

A development team is implementing authentication for a new application. They want to store user passwords securely. Which approach is the most secure practice for password storage?

During a threat modeling exercise, the team lists all the ways an attacker could interact with the system, such as the login page, API endpoints, and file upload functionality. Which element of the threat modeling process are they identifying?

A web application displays user-generated comments on a page. To prevent cross-site scripting (XSS) attacks, what should the application do before rendering the comments?

A developer is writing code that copies user input into a fixed-size buffer without checking the length. Which common coding vulnerability is the developer at risk of introducing?

Keep studying — Application Development and Security Fundamentals