Application Security ACCISO Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which threat modeling methodology uses a diagram to represent data flows, trust boundaries, and entry points?

   • AData Flow Diagram (DFD) based threat modeling
   • BSTRIDE
   • CPASTA
   • DCVSS scoring
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A development team is writing a Java web application that accepts user input and displays it on a dashboard. The security architect has mandated that all output be encoded. Which secure coding practice is the team applying to mitigate a specific OWASP Top 10 risk?

   • AContextual output encoding to prevent stored XSS.
   • BContent Security Policy headers to restrict script sources.
   • CParameterized queries to prevent SQL injection.
   • DInput validation to block malicious characters.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A team is threat modeling a new application that handles sensitive user data. They have limited time and must prioritize which threats to address. The application uses a third-party authentication service and stores data in a cloud database. Which approach best prioritizes threats?

   • ADefer threat modeling until after development is complete.
   • BFocus only on threats related to the third-party authentication service.
   • CUse a risk matrix to score threats based on likelihood and impact, focusing on the highest-scoring items.
   • DAddress all identified threats equally, regardless of likelihood.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company exposes a REST API for its mobile app. The security team is concerned about broken object level authorization (BOLA), where users can access other users' data by changing an ID in the request. Which control should be implemented to directly prevent this vulnerability?

   • AEnforce server-side authorization checks for every object access based on the authenticated user's permissions.
   • BRequire the client to hide the ID field in the user interface.
   • CUse a web application firewall (WAF) to block requests with suspicious IDs.
   • DEncrypt the ID parameter in transit using TLS.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A DevOps team wants to implement DevSecOps in their CI/CD pipeline. They face a conflict: developers want fast feedback, while the security team wants comprehensive testing before release. The team has a limited number of security testing licenses. Which strategy best resolves this conflict?

   • ARun DAST on every commit and SAST only before release.
   • BRun fast SAST on every commit and reserve DAST for staging before release.
   • CPerform manual penetration testing after every release.
   • DSkip security testing until the end of the development cycle.
   Reveal Solution Discussion Select an answer first