Application Security ACCISO Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A software company is updating its development process to integrate security earlier. The team wants to ensure that security requirements are considered before coding starts. Which SSDLC phase should be enhanced to achieve this?

   • ADesign phase
   • BImplementation phase
   • CTesting phase
   • DRequirements phase
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A financial services company is starting development of a new customer-facing web portal. The security team wants to identify and prioritize potential threats early in the project, before any code is written. The team has limited time and needs a structured approach that focuses on the most critical business risks. Which action best meets this need?

   • AConduct a threat modeling session using STRIDE during the design phase, then use the results to guide security requirements and test planning.
   • BAsk developers to follow secure coding guidelines and perform code reviews during implementation.
   • CRun a dynamic application security test (DAST) against a prototype of the portal to discover vulnerabilities.
   • DDeploy a web application firewall (WAF) in front of the portal after deployment to block common attacks.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A development team is using a microservices architecture with many internal APIs. They want to identify vulnerabilities in the source code and also test the running services for misconfigurations. The team has limited budget and wants to automate as much as possible. Which combination of testing methods should they implement?

   • ADAST in the CI pipeline and SAST in production.
   • BIAST in production and RASP in staging.
   • CManual code review and penetration testing only.
   • DSAST in the CI pipeline and DAST against the staging environment.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which secure coding practice is most effective in preventing SQL injection attacks?

   • AEncoding all user input with HTML entities
   • BDisabling error messages on the database server
   • CValidating input only on the client side
   • DUsing parameterized queries or prepared statements
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary goal of DevSecOps?

   • ATo ensure that security is only applied in production environments
   • BTo replace all manual security testing with automated tools
   • CTo separate security responsibilities from development and operations teams
   • DTo integrate security practices into the DevOps pipeline and automate security checks
   Reveal Solution Discussion Select an answer first