In a secure software development lifecycle (SSDLC), which activity is typically performed during the requirements phase?

Defining security requirements and potential threats

Deploying the application to production

Performing static code analysis on the source code

Conducting a penetration test on the final build

A healthcare organization is developing a mobile app that lets patients view their lab results. The app stores data locally on the device for offline access. Which two controls are most important to protect the data at rest and ensure compliance with healthcare regulations?

Minimize data stored and use a WAF for the backend API.

Use certificate pinning and disable screenshots.

Implement code obfuscation and root/jailbreak detection.

Encrypt the local database and implement strong device authentication.

Which security control is essential for protecting APIs from unauthorized access?

Implementing strong authentication and authorization mechanisms

Using HTTP instead of HTTPS for faster communication

Allowing all origins in CORS to simplify development

Disabling rate limiting to allow unlimited requests

What is the primary purpose of application security in the software development lifecycle?

To ensure the application complies with all international security standards

To ensure applications are free from all possible vulnerabilities before deployment

To identify, fix, and prevent security vulnerabilities throughout the entire lifecycle of an application

To perform a single security review after the application is fully developed

A multinational company is developing an application that processes personal data of EU citizens. The company must comply with GDPR. The development team wants to integrate security into the SDLC. Which practice is most directly required by GDPR for application development?

Store all data in the EU region to comply with data residency.

Implement a WAF to protect the application from web attacks.

Use SAST to scan the code for vulnerabilities.

Conduct a Data Protection Impact Assessment (DPIA) for high-risk processing activities before development begins.

EC-CouncilAssociate C|CISO

Domain 4Objective 5

Application Security ACCISO Practice Questions (Page 10)

Part of the Information Security Core Competencies domain, which makes up ~31% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–25 in this domain), expect 2–3 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

11concepts

Questions 46–50

46foundation · easy
In a secure software development lifecycle (SSDLC), which activity is typically performed during the requirements phase?
Select an answer first
47application · medium
A healthcare organization is developing a mobile app that lets patients view their lab results. The app stores data locally on the device for offline access. Which two controls are most important to protect the data at rest and ensure compliance with healthcare regulations?
Select an answer first
48foundation · easy
Which security control is essential for protecting APIs from unauthorized access?
Select an answer first
49foundation · easy
What is the primary purpose of application security in the software development lifecycle?
Select an answer first
50expert · hard
A multinational company is developing an application that processes personal data of EU citizens. The company must comply with GDPR. The development team wants to integrate security into the SDLC. Which practice is most directly required by GDPR for application development?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ACCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ACCISO” is a trademark of its owner, used for identification only.