A global company must comply with GDPR and PCI DSS for its customer-facing applications. The development team uses a CI/CD pipeline with automated testing. The security team is concerned that some automated tests may not fully cover compliance requirements. What is the most effective way to ensure compliance without slowing the pipeline?

Use a WAF to enforce compliance requirements.

Rely solely on SAST to identify all compliance issues.

Integrate compliance checks as automated gates in the pipeline, using both SAST and DAST, and include a manual review for compliance-specific requirements.

Perform a full manual compliance audit before every release.

What is the primary goal of threat modeling for an application?

To write secure code that prevents all attacks

To test the application for vulnerabilities after deployment

To monitor the application for attacks in real time

To identify and prioritize potential threats to the application

A development team is writing a web application that accepts user input and displays it on a dashboard. The security review has identified that the application is vulnerable to stored cross-site scripting (XSS). Which secure coding practice should the team implement to directly mitigate this vulnerability?

Disable JavaScript in the user's browser.

Encode all user-supplied data before rendering it in the browser.

Use parameterized queries for all database access.

Implement a web application firewall (WAF) to filter incoming requests.

A company is developing a public API that allows third-party developers to access user data. The API uses OAuth 2.0 for authorization. Which additional control is most important to prevent attackers from abusing the API with stolen access tokens?

Use a WAF to filter API requests.

Disable rate limiting to avoid blocking legitimate users.

Implement token expiration and revocation mechanisms.

Encode tokens in the URL for easy debugging.

Which of the following is an example of a regulatory requirement that impacts application security?

ISO 9001 quality management standards

IEEE 802.11 wireless networking standards

GDPR requirements for protecting personal data

EC-CouncilAssociate C|CISO

Domain 4Objective 5

Application Security ACCISO Practice Questions (Page 6)

Part of the Information Security Core Competencies domain, which makes up ~31% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–25 in this domain), expect 2–3 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

11concepts

Questions 26–30

26expert · hard
A global company must comply with GDPR and PCI DSS for its customer-facing applications. The development team uses a CI/CD pipeline with automated testing. The security team is concerned that some automated tests may not fully cover compliance requirements. What is the most effective way to ensure compliance without slowing the pipeline?
Select an answer first
27foundation · easy
What is the primary goal of threat modeling for an application?
Select an answer first
28application · medium
A development team is writing a web application that accepts user input and displays it on a dashboard. The security review has identified that the application is vulnerable to stored cross-site scripting (XSS). Which secure coding practice should the team implement to directly mitigate this vulnerability?
Select an answer first
29application · medium
A company is developing a public API that allows third-party developers to access user data. The API uses OAuth 2.0 for authorization. Which additional control is most important to prevent attackers from abusing the API with stolen access tokens?
Select an answer first
30foundation · easy
Which of the following is an example of a regulatory requirement that impacts application security?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ACCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ACCISO” is a trademark of its owner, used for identification only.

Application Security ACCISO Practice Questions (Page 6)

Questions 26–30

What is the primary goal of threat modeling for an application?

A company is developing a public API that allows third-party developers to access user data. The API uses OAuth 2.0 for authorization. Which additional control is most important to prevent attackers from abusing the API with stolen access tokens?

Which of the following is an example of a regulatory requirement that impacts application security?

Keep studying — Information Security Core Competencies