EC-CouncilCertified Application Security Engineer (.NET)
Domain 1Objective 4
Software Security Standards, Models, and Frameworks CASENET Practice Questions (Page 8)
Part of the Application Security Foundations domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 2–3 from this objective — we provide 68 practice questions to prepare you well beyond it. (estimate)
68questions here
14free pages
22concepts
Questions 36–40
- 36
A government contractor is required to follow NIST SSDF (SP 800-218) for a new .NET application. They have already implemented threat modeling and secure coding standards. During the build phase, they want to add a practice that directly addresses the identification of known vulnerabilities in third-party libraries. Which SSDF practice should they implement?
Select an answer first - 37
What is the primary purpose of PCI DSS?
Select an answer first - 38
An organization is implementing an Information Security Management System (ISMS) and wants to ensure that application security is considered within the overall governance framework. They have adopted ISO/IEC 27001 for certification. Which of the following best describes how ISO/IEC 27001 and ISO/IEC 27002 relate to application security?
Select an answer first - 39
Which access control model allows the owner of an object to decide who can access it?
Select an answer first - 40
Which of the following is a business function in OWASP OpenSAMM?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.