Application Security ACCISO Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A team is designing a new online payment system. During threat modeling, they use STRIDE to categorize threats. They identify that an attacker could tamper with the transaction amount in transit. Which STRIDE category does this threat fall under, and what is the most appropriate mitigation?

   • AInformation disclosure; encrypt the payload with TLS.
   • BDenial of service; implement rate limiting.
   • CTampering; use cryptographic integrity checks such as digital signatures.
   • DSpoofing; use mutual TLS authentication.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A large organization is adopting a secure SDLC. They have a legacy application that was developed without security considerations and is now critical to business operations. The team must integrate security without a full rewrite. Which approach best balances risk reduction and business continuity?

   • AConduct a threat model and risk assessment, then apply compensating controls such as a WAF and enhanced logging.
   • BImmediately rewrite the application using secure coding practices.
   • CDisable the application until security is fully integrated.
   • DDeploy the application to production and monitor for attacks.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is the purpose of aligning application security practices with regulatory requirements?

   • ATo make the application run faster
   • BTo eliminate the need for security testing
   • CTo ensure the application meets legal and industry standards for data protection
   • DTo reduce the number of features in the application
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   An organization is adopting DevSecOps and wants to automate security checks in its CI/CD pipeline without slowing down developers. The team needs to catch common vulnerabilities early while minimizing false positives. Which approach best balances speed and security?

   • ARun SAST in the pipeline on every commit, with a severity threshold that fails the build only for critical and high findings.
   • BRun DAST only after deployment to production, and manually review all findings.
   • CPerform a full penetration test once a year and fix all findings.
   • DRequire developers to run all security tools locally before every commit.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   An e-commerce company has deployed a WAF in front of its web application. The security team notices that legitimate users are occasionally blocked, and some SQL injection attempts are not being detected. What should the team do first?

   • AIncrease the WAF sensitivity to catch more attacks.
   • BReview the WAF logs and tune the rules to reduce false positives while maintaining detection.
   • CDisable the WAF to avoid blocking legitimate users.
   • DReplace the WAF with a RASP solution.
   Reveal Solution Discussion Select an answer first