Application Security CCISO Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A healthcare application stores patient records in a database. The security team wants to protect the data at rest and ensure that if the database is compromised, the attacker cannot read the actual patient names. Which control is most appropriate?

   • AUse a strong database password and assume that is sufficient.
   • BHash all patient names using SHA-256 and store only the hash values.
   • CEncrypt the database files using transparent data encryption (TDE) and also encrypt sensitive columns with application-level encryption.
   • DApply data masking only in the application's user interface.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following best describes how security is integrated into the SSDLC?

   • ASecurity is the sole responsibility of the security team and not developers
   • BSecurity is a separate phase that occurs only after the application is fully coded
   • CSecurity activities are performed only during the testing phase
   • DSecurity is considered in every phase, from requirements through maintenance
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A development team is writing a web application that accepts user input and uses it to build a database query. The team wants to prevent SQL injection. Which secure coding practice is the most effective?

   • AStore all user input in a separate table and never use it in queries.
   • BUse parameterized queries or prepared statements for all database access.
   • CEscape single quotes in all user input before including it in the query.
   • DValidate user input with a regular expression that only allows alphanumeric characters.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is a common DevSecOps practice?

   • APerforming manual penetration tests on every code commit
   • BKeeping security findings in a separate system that developers cannot access
   • CConducting security reviews only at the end of the project
   • DAutomating security scans (e.g., SAST, DAST) in the CI/CD pipeline
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security team must choose a testing strategy for a legacy application that has no source code available (only a compiled binary). The application is critical and cannot be taken offline. Which testing approach is most appropriate?

   • AStatic application security testing (SAST) on the compiled binary.
   • BInteractive application security testing (IAST) without instrumenting the application.
   • CRuntime application self-protection (RASP) to test the application in production.
   • DDynamic application security testing (DAST) against a staging instance that mirrors production.
   Reveal Solution Discussion Select an answer first