A company is exposing a public API that allows partners to retrieve customer data. The API uses API keys for authentication. The security team is concerned about the OWASP API Security Top 10 risk of excessive data exposure. Which control should be implemented to directly address this risk?

Use a WAF to block requests with unusual query parameters.

Require the client to request only the fields it needs.

Implement server-side response filtering to return only the fields the client is authorized to see.

A software company that processes credit card payments must comply with PCI DSS. They are adopting a DevOps model with frequent releases. Which practice best ensures that application security requirements are met without slowing the release cadence?

Embed security checks as automated gates in the CI/CD pipeline.

Require the security team to approve every code change manually.

Conduct a full manual penetration test before every release.

Defer all security testing until the annual compliance audit.

A mobile app development team is concerned about reverse engineering of their app, which contains proprietary algorithms. They also need to comply with data protection regulations. Which combination of controls should they implement?

Store all data in the cloud and none on the device.

Use only HTTPS for all network communication.

Code obfuscation and runtime integrity checks.

Disable app updates to prevent tampering.

A DevOps team wants to integrate security into their CI/CD pipeline without slowing down developers. They have a large codebase with many legacy components. Which approach best balances speed and security coverage?

Run DAST on every commit and SAST only before major releases.

Run SAST on every commit and DAST on the staging environment before release.

Perform manual penetration testing after each release.

Deploy a WAF in front of production and skip in-pipeline testing.

Which of the following is a security risk specific to mobile applications?

Lack of CSS styling in the user interface

Insecure data storage on the device

EC-CouncilAssociate C|CISO

Domain 4Objective 5

Application Security ACCISO Practice Questions (Page 1)

Part of the Information Security Core Competencies domain, which makes up ~31% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–25 in this domain), expect 2–3 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

11concepts

Questions 1–5

1expert · hard
A company is exposing a public API that allows partners to retrieve customer data. The API uses API keys for authentication. The security team is concerned about the OWASP API Security Top 10 risk of excessive data exposure. Which control should be implemented to directly address this risk?
Select an answer first
2application · medium
A software company that processes credit card payments must comply with PCI DSS. They are adopting a DevOps model with frequent releases. Which practice best ensures that application security requirements are met without slowing the release cadence?
Select an answer first
3application · medium
A mobile app development team is concerned about reverse engineering of their app, which contains proprietary algorithms. They also need to comply with data protection regulations. Which combination of controls should they implement?
Select an answer first
4application · medium
A DevOps team wants to integrate security into their CI/CD pipeline without slowing down developers. They have a large codebase with many legacy components. Which approach best balances speed and security coverage?
Select an answer first
5foundation · easy
Which of the following is a security risk specific to mobile applications?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ACCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ACCISO” is a trademark of its owner, used for identification only.