What is a common mitigation strategy for Injection flaws, as identified in the OWASP Top 10?

Disabling all user input fields

Using a Web Application Firewall (WAF) as the sole defense

Encoding all output with HTML entities

Which of the following is a common API vulnerability?

Lack of CSS styling in API responses

Slow response times due to network latency

Broken Object Level Authorization (BOLA)

Excessive use of RESTful methods

A mobile app development team is building an app that communicates with a backend API. The security team wants to ensure that the app's API calls are not intercepted or tampered with. The app will be distributed through public app stores. Which control should be implemented?

Implement certificate pinning in the app to validate the server's certificate against a known public key.

Encode the API requests in base64 to hide the data.

Rely on the operating system's default certificate validation.

Use a VPN on the user's device for all network traffic.

An organization has a public-facing web application protected by a WAF. The security team wants to reduce the risk of application-layer attacks such as SQL injection and XSS. Which WAF configuration is most effective for this purpose?

Use only default signature-based rules without tuning.

Set the WAF to monitoring mode only.

Enable logging of all requests without any filtering rules.

Enable positive security model rules that allow only expected traffic patterns.

EC-CouncilAssociate C|CISO

Domain 4Objective 5

Application Security ACCISO Practice Questions (Page 8)

Part of the Information Security Core Competencies domain, which makes up ~31% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–25 in this domain), expect 2–3 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

11concepts

Questions 36–40

36foundation · easy
What is a common mitigation strategy for Injection flaws, as identified in the OWASP Top 10?
Select an answer first
37foundation · easy
Which of the following is a common API vulnerability?
Select an answer first
38expert · hard
A mobile app development team is building an app that communicates with a backend API. The security team wants to ensure that the app's API calls are not intercepted or tampered with. The app will be distributed through public app stores. Which control should be implemented?
Select an answer first
39foundation · easy
Which of the following is listed in the OWASP Top 10 as a security risk?
Select an answer first
40application · medium
An organization has a public-facing web application protected by a WAF. The security team wants to reduce the risk of application-layer attacks such as SQL injection and XSS. Which WAF configuration is most effective for this purpose?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ACCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ACCISO” is a trademark of its owner, used for identification only.