Application Security ACCISO Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company is developing a mobile banking app that stores sensitive financial data on the device. The security team wants to protect the data if the device is lost or stolen. Which control should be implemented?

   • AUse certificate pinning to prevent man-in-the-middle attacks.
   • BEncrypt the data at rest using the device's hardware-backed keystore.
   • CImplement a jailbreak/root detection mechanism.
   • DStore all data in the app's internal storage without additional encryption.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A development team is fixing a SQL injection vulnerability found in a login form. The form takes a username and password and directly concatenates them into a SQL query. Which code change should be made to securely fix this issue?

   • AValidate the input to allow only alphanumeric characters.
   • BUse parameterized queries or prepared statements for all database operations.
   • CEscape single quotes in the user input before concatenating it into the query.
   • DStore the username and password in a separate database table.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which configuration consideration is important when deploying a WAF?

   • AConfiguring the WAF to allow all traffic by default
   • BDisabling logging to improve performance
   • CPlacing the WAF behind the application server
   • DPlacing the WAF in front of the application to inspect all incoming traffic
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which protection is commonly used to secure data stored on a mobile device?

   • ADisabling all local storage features
   • BRelying solely on app sandboxing
   • CStoring all data in plain text for performance
   • DUsing the platform's built-in encryption APIs
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A company has deployed a WAF in front of its web application. After enabling the WAF, legitimate users are being blocked, and the security team suspects the WAF rules are too aggressive. The application also uses a REST API. Which configuration change should be made to reduce false positives while maintaining protection?

   • AEnable the WAF in detection mode first, review the logs, and then adjust rules to block only confirmed attack patterns.
   • BDisable the WAF entirely to avoid blocking legitimate users.
   • CSet the WAF to block all requests that contain any special characters.
   • DUse the WAF's default rule set without any customization.
   Reveal Solution Discussion Select an answer first