A team is designing a new system that will handle sensitive customer data. The security architect wants to implement defense in depth. However, the budget is limited. Which of the following is the MOST cost-effective way to implement defense in depth?

Implement security controls only at the application layer to reduce infrastructure costs.

Purchase an expensive next-generation firewall and rely on it as the primary security control.

Use a cloud provider's managed security services, which are always the cheapest option.

Implement a combination of free and open-source security controls, such as a web application firewall, input validation, and encryption.

A company is designing a microservices-based order processing system. Each service will have its own database. The security architect wants to apply the principle of least privilege. Which design decision BEST aligns with this principle?

The database administrator grants all services full access to the database during development and plans to restrict later.

Each service uses the same database account but with row-level security filters to restrict data access.

All services share a single database account with broad permissions to simplify credential management.

Each service uses a dedicated database account with permissions limited to its own tables and required operations.

A security architect is reviewing a design for a new multi-tenant SaaS application. The design uses a single shared database for all tenants. The team is concerned about cross-tenant data leakage. Which design review recommendation is most effective?

Add a WAF to protect against SQL injection

Encrypt the entire database with a single key

Use a separate database for each tenant

Implement row-level security in the database to filter data by tenant ID

During a security design review of a new file-upload service, the team identifies that the service does not restrict file types. Which design change best addresses this finding?

Renaming files to random names after upload

Adding a CAPTCHA to the upload form

Implementing an allowlist of permitted file extensions and validating file content

Storing files in a separate bucket with public read access

A DevSecOps team is designing a new payment gateway. The threat model identifies two critical threats: (1) an attacker could tamper with transaction amounts, and (2) an attacker could replay a valid transaction to duplicate a charge. The team has limited development resources and must choose a single control that addresses both threats. Which control is the MOST effective?

Use a checksum of the transaction payload.

Use TLS for all communications.

Use a digital signature over the transaction payload, including a nonce and timestamp.

Use a unique transaction ID for each request.

EC-CouncilCertified DevSecOps Engineer

Domain 3Objective 3

Security by Design ECDE Practice Questions (Page 4)

Part of the Code and Build Stage: SAST and Secure Code Review domain, which makes up ~15% of our current practice bank.

44questions here

9free pages

5concepts

Questions 16–20

16expert · hard
A team is designing a new system that will handle sensitive customer data. The security architect wants to implement defense in depth. However, the budget is limited. Which of the following is the MOST cost-effective way to implement defense in depth?
Select an answer first
17application · medium
A company is designing a microservices-based order processing system. Each service will have its own database. The security architect wants to apply the principle of least privilege. Which design decision BEST aligns with this principle?
Select an answer first
18expert · hard
A security architect is reviewing a design for a new multi-tenant SaaS application. The design uses a single shared database for all tenants. The team is concerned about cross-tenant data leakage. Which design review recommendation is most effective?
Select an answer first
19application · medium
During a security design review of a new file-upload service, the team identifies that the service does not restrict file types. Which design change best addresses this finding?
Select an answer first
20expert · hard
A DevSecOps team is designing a new payment gateway. The threat model identifies two critical threats: (1) an attacker could tamper with transaction amounts, and (2) an attacker could replay a valid transaction to duplicate a charge. The team has limited development resources and must choose a single control that addresses both threats. Which control is the MOST effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECDE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECDE” is a trademark of its owner, used for identification only.