Which of the following is a common technique used in threat modeling to systematically identify potential attack vectors?

Runtime application self-protection

During a security design review, which of the following activities is most likely to be performed?

Reviewing the data flow and trust boundaries in the proposed architecture

Deploying the application to a staging environment

Executing unit tests on the codebase

Running a vulnerability scanner against the production environment

A team is designing a new online banking system. During threat modeling, they identify that an attacker could perform a man-in-the-middle attack to intercept session tokens. Which of the following is the MOST effective mitigation to include in the design?

Store session tokens in local storage instead of cookies.

Use a longer session token to make it harder to guess.

Implement IP-based session binding.

Use HTTPS with HSTS and secure cookie flags.

During the design stage, a threat modeling exercise is conducted. What is the primary output of this exercise?

A set of automated security test cases

A prioritized list of potential threats and vulnerabilities that could affect the system

A detailed network diagram of the production environment

A list of all possible software bugs in the code

EC-CouncilCertified DevSecOps Engineer

Domain 3Objective 3

Security by Design ECDE Practice Questions (Page 1)

Part of the Code and Build Stage: SAST and Secure Code Review domain, which makes up ~15% of our current practice bank.

44questions here

9free pages

5concepts

Questions 1–5

1foundation · easy
Which of the following is a common technique used in threat modeling to systematically identify potential attack vectors?
Select an answer first
2foundation · easy
During a security design review, which of the following activities is most likely to be performed?
Select an answer first
3application · medium
A team is designing a new online banking system. During threat modeling, they identify that an attacker could perform a man-in-the-middle attack to intercept session tokens. Which of the following is the MOST effective mitigation to include in the design?
Select an answer first
4foundation · easy
During the design stage, a threat modeling exercise is conducted. What is the primary output of this exercise?
Select an answer first
5application · medium
A team is designing a new e-commerce platform. They want to ensure that if a security control fails, the system does not expose sensitive data. Which design principle should they apply?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECDE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECDE” is a trademark of its owner, used for identification only.