A company exposes a REST API that allows partners to retrieve customer order data. The API uses API keys in the query string for authentication. A security review flags this as a risk. Which control should the company implement to address the most immediate vulnerability?

Use a WAF to filter malicious API requests.

Add input validation to all API parameters.

Move API keys to the Authorization header and enforce HTTPS.

Implement rate limiting on the API endpoint.

A company is adopting DevSecOps and wants to ensure that security is integrated into their CI/CD pipeline. They have a mix of containerized and non-containerized applications. Which approach provides the most comprehensive automated security coverage?

Deploy a WAF and rely on it for all security.

Run DAST only on the production environment.

Perform manual security reviews before each release.

Use SAST, dependency scanning, and container image scanning in the pipeline.

Which testing method is most suitable for identifying vulnerabilities in a running web application from an external perspective?

Dynamic Application Security Testing (DAST)

Static Application Security Testing (SAST)

Interactive Application Security Testing (IAST)

Runtime Application Self-Protection (RASP)

A security analyst is reviewing a web application and finds that user-supplied filenames are used directly in file system paths without sanitization. This allows an attacker to overwrite arbitrary files on the server. Which OWASP Top 10 category does this vulnerability belong to, and what is the best mitigation?

Security Misconfiguration; enable verbose error messages.

Broken Access Control; implement a whitelist of allowed filenames and use a secure file-handling library.

Injection; use parameterized queries.

XSS; encode the filename before displaying it.

Which of the following best describes how security is integrated into the design phase of a secure SDLC?

Security is not considered until the testing phase

Developers write code without any security guidance

Threat modeling and security architecture reviews are conducted

Security controls are added only after the application is deployed

EC-CouncilAssociate C|CISO

Domain 4Objective 5

Application Security ACCISO Practice Questions (Page 2)

Part of the Information Security Core Competencies domain, which makes up ~31% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–25 in this domain), expect 2–3 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

11concepts

Questions 6–10

6application · medium
A company exposes a REST API that allows partners to retrieve customer order data. The API uses API keys in the query string for authentication. A security review flags this as a risk. Which control should the company implement to address the most immediate vulnerability?
Select an answer first
7application · medium
A company is adopting DevSecOps and wants to ensure that security is integrated into their CI/CD pipeline. They have a mix of containerized and non-containerized applications. Which approach provides the most comprehensive automated security coverage?
Select an answer first
8foundation · easy
Which testing method is most suitable for identifying vulnerabilities in a running web application from an external perspective?
Select an answer first
9application · medium
A security analyst is reviewing a web application and finds that user-supplied filenames are used directly in file system paths without sanitization. This allows an attacker to overwrite arbitrary files on the server. Which OWASP Top 10 category does this vulnerability belong to, and what is the best mitigation?
Select an answer first
10foundation · easy
Which of the following best describes how security is integrated into the design phase of a secure SDLC?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ACCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ACCISO” is a trademark of its owner, used for identification only.