A financial services firm is adopting a new SSDLC and wants to identify security requirements early in the lifecycle. The team is about to define the architecture for a customer-facing loan application. Which activity should the security team lead at this stage?

Deploy a web application firewall (WAF) in front of the application to block attacks at runtime.

Review the OWASP Top 10 list and mandate that all listed vulnerabilities be avoided without further analysis.

Run a dynamic application security test (DAST) against the production environment to find live vulnerabilities.

Conduct a threat modeling session to identify assets, trust boundaries, and potential attack vectors before coding begins.

A mobile app development team wants to protect sensitive data stored on the device. They are considering using SQLCipher to encrypt the local database. What additional control is necessary to protect the encryption key?

Hardcode the encryption key in the application source code.

Store the encryption key in the platform's secure key store (e.g., Android Keystore or iOS Keychain).

Store the key in a shared preferences file with the database.

Use a key derived from the user's password without any salt.

A DevOps team wants to integrate security testing into their CI/CD pipeline. They need to catch vulnerabilities early in the development cycle without requiring a running application. Which testing approach should they prioritize?

Static application security testing (SAST) on the source code during the build stage.

Dynamic application security testing (DAST) against a staging environment after deployment.

Interactive application security testing (IAST) that requires a deployed application and test traffic.

Runtime application self-protection (RASP) integrated into the production application.

Which secure coding practice is most effective in preventing SQL injection vulnerabilities?

Using parameterized queries or prepared statements

Disabling error messages on the production server

Encoding all output before displaying it

Using a web application firewall (WAF)

What is the primary purpose of rate limiting in API security?

To prevent abuse and denial-of-service attacks by limiting the number of requests a client can make

To encrypt data transmitted between the client and the API

To validate the format of API requests

EC-CouncilCertified Chief Information Security Officer

Domain 4Objective 5

Application Security CCISO Practice Questions (Page 13)

Part of the Information Security Core Competencies domain, which makes up ~33% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~20–33 in this domain), expect 3–4 from this objective — we provide 65 practice questions to prepare you well beyond it. (estimate)

65questions here

13free pages

15concepts

15 Concepts in This Objective

Application Security Fundamentals
Secure Software Development Lifecycle (SSDLC)
Threat Modeling
Secure Coding Practices
Application Security Testing
OWASP Top 10
Authentication and Authorization
Data Protection in Applications
Application Security Controls
API Security
Mobile Application Security
Cloud Application Security
DevSecOps
Application Security Governance
Incident Response for Applications

Questions 61–65

61application · medium
A financial services firm is adopting a new SSDLC and wants to identify security requirements early in the lifecycle. The team is about to define the architecture for a customer-facing loan application. Which activity should the security team lead at this stage?
Select an answer first
62expert · hard
A mobile app development team wants to protect sensitive data stored on the device. They are considering using SQLCipher to encrypt the local database. What additional control is necessary to protect the encryption key?
Select an answer first
63application · medium
A DevOps team wants to integrate security testing into their CI/CD pipeline. They need to catch vulnerabilities early in the development cycle without requiring a running application. Which testing approach should they prioritize?
Select an answer first
64foundation · easy
Which secure coding practice is most effective in preventing SQL injection vulnerabilities?
Select an answer first
65foundation · easy
What is the primary purpose of rate limiting in API security?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.