Which application security testing method analyzes source code without executing the application?

Interactive Application Security Testing (IAST)

Runtime Application Self-Protection (RASP)

Dynamic Application Security Testing (DAST)

Static Application Security Testing (SAST)

A company has a CI/CD pipeline that builds a containerized web application. The security team wants to add automated security testing but has limited budget and time. They need to catch vulnerabilities in both the source code and the container image. Which combination of testing tools should be integrated into the pipeline?

Run SAST on the source code and a container image scanner on the built image.

Run a single SAST tool that also scans the container image.

Run DAST against the running application and rely on the WAF for source-code issues.

Run IAST during integration tests and skip container scanning.

A healthcare organization is developing a patient portal that handles protected health information (PHI). The compliance officer requires that security controls be integrated into every phase of the software development lifecycle. Which approach best satisfies this requirement?

Use only secure coding practices during implementation.

Perform a single security review after the application is fully developed.

Adopt a secure SDLC (SSDLC) framework that includes security requirements, threat modeling, secure coding standards, security testing, and post-deployment monitoring.

Rely on the WAF to protect the application after deployment.

What is the primary defense against Cross-Site Scripting (XSS) attacks?

Using HTTPS for all communications

Disabling JavaScript in the user's browser

Implementing rate limiting on login endpoints

Output encoding/escaping of user-controlled data

Why is application security important in the software development lifecycle?

It eliminates the need for network security controls

It guarantees that applications will never be attacked

It ensures that applications are developed faster by skipping security reviews

It helps prevent data breaches and reduces the cost of fixing vulnerabilities later

EC-CouncilAssociate C|CISO

Domain 4Objective 5

Application Security ACCISO Practice Questions (Page 11)

Part of the Information Security Core Competencies domain, which makes up ~31% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–25 in this domain), expect 2–3 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

11concepts

Questions 51–55

51foundation · easy
Which application security testing method analyzes source code without executing the application?
Select an answer first
52expert · hard
A company has a CI/CD pipeline that builds a containerized web application. The security team wants to add automated security testing but has limited budget and time. They need to catch vulnerabilities in both the source code and the container image. Which combination of testing tools should be integrated into the pipeline?
Select an answer first
53application · medium
A healthcare organization is developing a patient portal that handles protected health information (PHI). The compliance officer requires that security controls be integrated into every phase of the software development lifecycle. Which approach best satisfies this requirement?
Select an answer first
54foundation · easy
What is the primary defense against Cross-Site Scripting (XSS) attacks?
Select an answer first
55foundation · easy
Why is application security important in the software development lifecycle?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ACCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ACCISO” is a trademark of its owner, used for identification only.