Application Security CCISO Practice Questions (Page 11)

Questions 51–55

1. 51application · medium

   A large organization has multiple development teams building different applications. The security team has noticed that security requirements are applied inconsistently across teams, and some teams skip security testing to meet deadlines. The CISO wants to establish a governance framework to ensure consistent application security across the organization. Which action should be taken first?

   • ADevelop and publish an application security policy that defines mandatory security requirements and testing gates.
   • BCreate a security champions program and let each team decide its own security practices.
   • CHire more security engineers to manually review every application.
   • DPurchase an expensive SAST tool and require all teams to use it immediately.
   Reveal Solution Discussion Select an answer first
2. 52foundation · easy

   Why is application security important in the software development lifecycle?

   • AIt reduces the cost and impact of security vulnerabilities by addressing them early in development
   • BIt is only required for applications that handle financial data
   • CIt guarantees that the application will never be hacked after deployment
   • DIt replaces the need for network security and other security layers
   Reveal Solution Discussion Select an answer first
4. 53expert · hard

   A web application has a login form that is vulnerable to brute-force attacks. The security team wants to implement controls to mitigate this risk without degrading the user experience for legitimate users. They are considering account lockout, CAPTCHA, and rate limiting. Which combination of controls is the most balanced?

   • AShow a CAPTCHA on every login attempt, regardless of the user's history.
   • BUse only rate limiting with a very low threshold, such as one attempt per minute.
   • CImplement rate limiting on the login endpoint and CAPTCHA only after a certain number of failed attempts.
   • DLock out the account after three failed attempts and require a password reset.
   Reveal Solution Discussion Select an answer first
5. 54foundation · easy

   Which of the following is a shared responsibility in cloud application security?

   • ASecuring the application code and configuration
   • BPatching the hypervisor
   • CPhysical security of the data center
   • DManaging the network infrastructure
   Reveal Solution Discussion Select an answer first
6. 55application · medium

   A company is migrating a legacy application to the cloud. The application currently uses username/password authentication stored in its own database. The security team wants to improve identity management and reduce the risk of credential theft. Which approach is most aligned with cloud security best practices?

   • AContinue storing credentials in the application database but hash them with MD5.
   • BMove the database to the cloud but keep the same authentication logic.
   • CCreate a separate username/password for each cloud resource the application uses.
   • DIntegrate the application with the cloud provider's identity service (e.g., Azure AD) using SAML or OIDC.
   Reveal Solution Discussion Select an answer first