Application Security ACCISO Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A developer is writing code that deserializes data received from a client application. The security team has warned about insecure deserialization. Which practice should the developer adopt to mitigate this risk?

   • ASign the serialized data with a secret key.
   • BEncode all serialized data with base64 before transmission.
   • CValidate and restrict the classes that can be deserialized, and use a safe deserialization library.
   • DUse a WAF to filter serialized data.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company has a WAF in front of its web application. The security team is seeing a high number of false positives, which are blocking legitimate users. At the same time, the team wants to maintain strong protection against OWASP Top 10 risks. What is the best approach to reduce false positives without weakening security?

   • AIncrease the WAF sensitivity to catch more attacks.
   • BAnalyze WAF logs to identify patterns, then create custom rules that whitelist legitimate traffic while keeping core rules enabled.
   • CDisable the WAF rules that are causing false positives.
   • DSwitch the WAF to monitoring mode permanently.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which practice is commonly used to automate security checks in a CI/CD pipeline?

   • ARunning SAST scans on every code commit
   • BDisabling security tools to speed up builds
   • CPerforming manual penetration tests after each release
   • DReviewing security logs only after a breach
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company is deploying a public-facing web application and wants to add a layer of protection against common web attacks such as SQL injection and cross-site scripting. The application is behind a load balancer and uses HTTPS. Which control should be implemented?

   • AImplement a network access control list (NACL) to restrict source IP addresses.
   • BEnable TLS 1.3 on the load balancer.
   • CDeploy a web application firewall (WAF) in front of the application and configure managed rules for OWASP Top 10.
   • DUse a content delivery network (CDN) to cache static content.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A financial services company is deploying a new customer-facing web application. The security team has completed threat modeling and identified SQL injection and cross-site scripting (XSS) as the top risks. The application is built on a modern framework with strong input validation, and the team wants to validate that the deployed application is free of these vulnerabilities in a production-like environment. Which testing approach should the team prioritize?

   • APerform a manual code review of all input validation logic.
   • BDeploy a RASP agent to the production environment and monitor for attacks.
   • CRun a SAST scan on the source code repository.
   • DRun a DAST tool against the staging environment with the same configuration as production.
   Reveal Solution Discussion Select an answer first