Application Security CCISO Practice Questions (Page 12)

Questions 56–60

1. 56foundation · easy

   What is the difference between authentication and authorization in application security?

   • AAuthentication is a one-time process; authorization is continuous
   • BAuthentication verifies identity; authorization verifies what an authenticated user is allowed to do
   • CAuthentication is used only for external users; authorization is for internal users
   • DAuthentication controls access to resources; authorization verifies identity
   Reveal Solution Discussion Select an answer first
2. 57foundation · easy

   Which application security testing method analyzes source code without executing the application?

   • AIAST (Interactive Application Security Testing)
   • BSAST (Static Application Security Testing)
   • CRASP (Runtime Application Self-Protection)
   • DDAST (Dynamic Application Security Testing)
   Reveal Solution Discussion Select an answer first
4. 58foundation · easy

   Which of the following is a structured threat modeling technique commonly used to identify and prioritize threats?

   • AOWASP ASVS
   • BSTRIDE
   • CSAST
   • DRASP
   Reveal Solution Discussion Select an answer first
5. 59foundation · easy

   Which of the following is an example of an application security governance activity?

   • AConfiguring a firewall for a web server
   • BDeveloping a secure coding standard that all developers must follow
   • CRunning a vulnerability scanner on a single application
   • DResponding to a security incident in an application
   Reveal Solution Discussion Select an answer first
6. 60application · medium

   A financial services company is deploying a new customer-facing web application. The security team has completed threat modeling and identified SQL injection and cross-site scripting as top risks. The team wants to catch these vulnerabilities early in the development process, before the application is deployed, and also verify that the fixes are effective. Which combination of testing approaches best meets this need?

   • ARun RASP in the staging environment and SAST in production after deployment.
   • BRun DAST during the build phase and SAST against the production environment after release.
   • CRun only IAST during the build phase and rely on code review for the rest.
   • DRun SAST during the build phase and DAST against a staging environment before release.
   Reveal Solution Discussion Select an answer first