A team is conducting a threat model for a new feature that allows users to upload profile pictures. The feature stores files in cloud storage and serves them back. Which threat modeling consideration is most important for prioritizing code review?

The team should review the database schema for the user profile.

The cloud storage bucket is private, so no additional review is needed.

The feature uses HTTPS, so the upload is secure.

The file upload endpoint is publicly accessible and accepts arbitrary file types, so review should focus on file validation and content-type checks.

A small team is about to merge a new authentication module. They have a SAST tool that runs in CI, but the module handles password resets and session management. The team has limited time for a manual review. Which approach is most appropriate?

Skip manual review because the module is small and the team is experienced.

Rely solely on SAST results because the tool covers all common vulnerability categories.

Run SAST after the merge and fix any findings in a later sprint.

Perform a focused manual review of the authentication logic and use SAST to scan the entire codebase for common issues.

A team is designing their DevSecOps pipeline and wants to integrate code review. They have a mix of legacy and new code. They want to ensure that security review is performed at the right time without slowing down the pipeline. Which strategy is most effective?

Require security review only on new code, and ignore legacy code because it is being replaced.

Require security review only on legacy code, because new code is written by experienced developers.

Run SAST only on the main branch and do not perform manual review.

Require security review on all pull requests for new code, and schedule periodic reviews for legacy code.

A SAST tool is reporting a high number of false positives for a specific rule. The team has verified that the rule is not relevant to their codebase. What is the best way to handle this?

Increase the severity of the rule to make it more visible.

Disable the rule in the SAST tool configuration.

Ignore the findings and leave the rule enabled.

Run the SAST tool only on weekends.

A team is creating a secure code review checklist for a Node.js application that uses a NoSQL database. Which item is most relevant to include?

Check that all JavaScript files are minified.

Confirm that all functions are asynchronous.

Verify that all database queries use parameterized or sanitized inputs to prevent NoSQL injection.

Ensure that all dependencies are up to date.

EC-CouncilCertified DevSecOps Engineer

Domain 3Objective 4

Code Review Strategy ECDE Practice Questions (Page 1)

Part of the Code and Build Stage: SAST and Secure Code Review domain, which makes up ~15% of our current practice bank.

36questions here

8free pages

9concepts

Questions 1–5

1expert · hard
A team is conducting a threat model for a new feature that allows users to upload profile pictures. The feature stores files in cloud storage and serves them back. Which threat modeling consideration is most important for prioritizing code review?
Select an answer first
2application · medium
A small team is about to merge a new authentication module. They have a SAST tool that runs in CI, but the module handles password resets and session management. The team has limited time for a manual review. Which approach is most appropriate?
Select an answer first
3expert · hard
A team is designing their DevSecOps pipeline and wants to integrate code review. They have a mix of legacy and new code. They want to ensure that security review is performed at the right time without slowing down the pipeline. Which strategy is most effective?
Select an answer first
4application · medium
A SAST tool is reporting a high number of false positives for a specific rule. The team has verified that the rule is not relevant to their codebase. What is the best way to handle this?
Select an answer first
5application · medium
A team is creating a secure code review checklist for a Node.js application that uses a NoSQL database. Which item is most relevant to include?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECDE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECDE” is a trademark of its owner, used for identification only.