A DevSecOps team is integrating security into their CI/CD pipeline. They want to catch common vulnerabilities early in the development process. Which practice should they implement in the build phase of the pipeline?

Review the application's firewall rules after deployment.

Conduct a threat modeling session with the security team after the release.

Run a static application security testing (SAST) tool on the source code.

Perform a penetration test on the production environment after each release.

A web application displays user-generated comments on a public page. The development team is concerned about stored XSS attacks. They have implemented server-side input validation that rejects any input containing ' '. What additional control is necessary to effectively prevent stored XSS?

Use a Content Security Policy (CSP) that disallows inline scripts.

Remove all HTML tags from the input before storing it.

Store the comments in a database field with a maximum length of 500 characters.

Apply output encoding when rendering the comments in the HTML page.

A security auditor is reviewing the logging practices of an application. The auditor wants to ensure that logs support forensic analysis without exposing sensitive data. Which logging practice is most appropriate?

Log full request bodies including passwords for debugging

Disable logging in production to reduce storage costs

Log only error messages without any context

Log security-relevant events with timestamps and user identifiers, but mask sensitive fields like passwords and tokens

An application needs to store credit card numbers and later retrieve them for a recurring billing process. The compliance team requires that the data be protected at rest. Which cryptographic approach is most appropriate?

Encrypt the card numbers with AES-256 using a key managed by a hardware security module (HSM)

Store the numbers in a separate database without encryption

Use base64 encoding to obscure the numbers

Hash the card numbers with SHA-256

EC-CouncilDevSecOps Essentials

Domain 1Objective 5

Secure Design Principles, Threat Modeling, and Secure Coding DSE Practice Questions (Page 7)

Part of the Application Development and Security Fundamentals domain, which makes up ~20% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 2–3 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

10concepts

10 Concepts in This Objective

Secure Design Principles
Threat Modeling Process
Threat Identification Techniques
Risk Assessment and Mitigation
Secure Coding Fundamentals
Input Validation and Output Encoding
Authentication and Authorization Controls
Error Handling and Logging
Cryptography in Application Security
Secure Development Lifecycle Integration

Questions 31–35

31application · medium
A DevSecOps team is integrating security into their CI/CD pipeline. They want to catch common vulnerabilities early in the development process. Which practice should they implement in the build phase of the pipeline?
Select an answer first
32application · medium
A web application displays user-generated comments on a public page. The development team is concerned about stored XSS attacks. They have implemented server-side input validation that rejects any input containing '<script>'. What additional control is necessary to effectively prevent stored XSS?
Select an answer first
33application · medium
A security auditor is reviewing the logging practices of an application. The auditor wants to ensure that logs support forensic analysis without exposing sensitive data. Which logging practice is most appropriate?
Select an answer first
34foundation · easy
In a secure software architecture, a system is designed so that if a security control fails, the system defaults to a state that denies access rather than allowing it. Which secure design principle does this behavior exemplify?
Select an answer first
35application · medium
An application needs to store credit card numbers and later retrieve them for a recurring billing process. The compliance team requires that the data be protected at rest. Which cryptographic approach is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DSE” is a trademark of its owner, used for identification only.

Secure Design Principles, Threat Modeling, and Secure Coding DSE Practice Questions (Page 7)

Questions 31–35

A DevSecOps team is integrating security into their CI/CD pipeline. They want to catch common vulnerabilities early in the development process. Which practice should they implement in the build phase of the pipeline?

A web application displays user-generated comments on a public page. The development team is concerned about stored XSS attacks. They have implemented server-side input validation that rejects any input containing '<script>'. What additional control is necessary to effectively prevent stored XSS?

A security auditor is reviewing the logging practices of an application. The auditor wants to ensure that logs support forensic analysis without exposing sensitive data. Which logging practice is most appropriate?

In a secure software architecture, a system is designed so that if a security control fails, the system defaults to a state that denies access rather than allowing it. Which secure design principle does this behavior exemplify?

An application needs to store credit card numbers and later retrieve them for a recurring billing process. The compliance team requires that the data be protected at rest. Which cryptographic approach is most appropriate?

Keep studying — Application Development and Security Fundamentals