Why can using outdated third-party libraries make an application vulnerable?

They may contain known security flaws that have been fixed in newer versions

They are not compatible with modern browsers

They increase the application's memory usage

They always have more bugs than custom code

A company is using a legacy library in its application. The library is no longer maintained and has a known vulnerability. The team is considering options to address this risk. Which approach is most effective in the long term?

Monitor the library's vulnerability disclosures and hope for a fix

Apply a virtual patch using a web application firewall

Isolate the application from the internet

Replace the legacy library with a maintained alternative

A developer is asked to fix a bug in a legacy application. The developer does not fully understand the authentication logic and, to make the fix work, disables a critical security check. The application is deployed and later compromised. Which human factor is most directly responsible?

Misconfiguration in the deployment environment

External attacker sophistication

Third-party library vulnerability

Lack of training and understanding of the codebase

How does adding a new feature to an application typically affect its attack surface?

It only affects the attack surface if the feature is insecure

It has no effect on the attack surface

A company's application uses a third-party component that has a known vulnerability. The component is widely used and a patch is available, but the company has not applied it because the patch is known to break some functionality. The company is considering options. Which approach is most appropriate?

Apply the patch directly to production without testing

Do not apply the patch because it may break functionality

Remove the third-party component and rewrite the functionality

Apply the patch in a staging environment, test the affected functionality, and then deploy to production

EC-CouncilCertified Application Security Engineer (.NET)

Domain 1Objective 3

Why Applications Become Vulnerable to Attacks CASENET Practice Questions (Page 3)

Part of the Application Security Foundations domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 2–3 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

7concepts

Questions 11–15

11foundation · easy
Why can using outdated third-party libraries make an application vulnerable?
Select an answer first
12application · medium
A company is using a legacy library in its application. The library is no longer maintained and has a known vulnerability. The team is considering options to address this risk. Which approach is most effective in the long term?
Select an answer first
13application · medium
A developer is asked to fix a bug in a legacy application. The developer does not fully understand the authentication logic and, to make the fix work, disables a critical security check. The application is deployed and later compromised. Which human factor is most directly responsible?
Select an answer first
14foundation · easy
How does adding a new feature to an application typically affect its attack surface?
Select an answer first
15expert · hard
A company's application uses a third-party component that has a known vulnerability. The component is widely used and a patch is available, but the company has not applied it because the patch is known to break some functionality. The company is considering options. Which approach is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.