A payment processing application has a vulnerability that allows an attacker to inject malicious SQL queries. The team is required to fix this issue to maintain PCI DSS compliance. Which combination of actions is most appropriate?

Use input validation and track the weakness as CVE-2024-1234

Use stored procedures and track the weakness as CWE-79

Use output encoding and track the weakness as CWE-89

Use parameterized queries and track the weakness as CWE-89

Which PCI DSS requirement is directly related to secure application development?

Requirement 10: Log and monitor all access

Requirement 1: Install and maintain network security controls

Requirement 6: Develop and maintain secure systems and software

Requirement 3: Protect stored account data

What is the primary purpose of the Building Security In Maturity Model (BSIMM)?

To provide a list of common vulnerabilities

To replace the need for security testing

To assess and improve software security initiatives

Which of the following is a key component of the COBIT framework?

Governance and management objectives

Which of the following is a key component of ISO/IEC 27034?

Security Content Automation Protocol (SCAP)

Application Security Control Framework (ASCF)

Common Vulnerability Scoring System (CVSS)

EC-CouncilCertified Application Security Engineer (.NET)

Domain 1Objective 4

Software Security Standards, Models, and Frameworks CASENET Practice Questions (Page 11)

Part of the Application Security Foundations domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 2–3 from this objective — we provide 68 practice questions to prepare you well beyond it. (estimate)

68questions here

14free pages

22concepts

22 Concepts in This Objective

Software Security Standards Overview
OWASP Top 10
OWASP Software Assurance Maturity Model (SAMM)
ISO/IEC 27034
NIST Secure Software Development Framework (SSDF)
CWE and CVE
PCI DSS for Application Security
ISO/IEC 27001 and 27002
Security Models Overview
Bell-LaPadula Model
Biba Model
Clark-Wilson Model
Access Control Models
Secure Development Frameworks
Microsoft Security Development Lifecycle (SDL)
OWASP OpenSAMM
Building Security In Maturity Model (BSIMM)
Common Criteria
ISO/IEC 15408
COBIT for Application Security
ISO/IEC 27034-1
Security Frameworks Comparison

Questions 51–55

51expert · hard
A payment processing application has a vulnerability that allows an attacker to inject malicious SQL queries. The team is required to fix this issue to maintain PCI DSS compliance. Which combination of actions is most appropriate?
Select an answer first
52foundation · easy
Which PCI DSS requirement is directly related to secure application development?
Select an answer first
53foundation · easy
What is the primary purpose of the Building Security In Maturity Model (BSIMM)?
Select an answer first
54foundation · easy
Which of the following is a key component of the COBIT framework?
Select an answer first
55foundation · easy
Which of the following is a key component of ISO/IEC 27034?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.