Application Security CCISO Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In the Secure Software Development Lifecycle (SSDLC), which activity is typically performed during the requirements phase?

   • ADefining security requirements and identifying compliance obligations
   • BConducting a penetration test on the final build
   • CPerforming static code analysis on the source code
   • DDeploying the application to a production environment
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A web application allows users to upload profile pictures. The security team is concerned about malicious file uploads leading to remote code execution. Which set of controls should be implemented?

   • AAllow any file type but rename the file to a random name and store it in the web root.
   • BStore the file in a database as a BLOB and retrieve it without any content-type validation.
   • COnly check the file extension and reject .exe files.
   • DValidate the file extension and MIME type, store files outside the web root, and serve them with a Content-Disposition header.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company's web application was compromised through a SQL injection vulnerability. The incident response team has confirmed that the attacker exfiltrated a database of customer records. The CISO wants to ensure that the incident response plan is updated to prevent similar issues in the future. Which action should be included in the post-incident review?

   • ANotify the customers and offer credit monitoring, then close the incident.
   • BRestore the database from the last backup and change all customer passwords.
   • CConduct a root cause analysis and update the secure coding standards and testing requirements to include SQL injection checks.
   • DDelete the compromised database and rebuild the application from scratch.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is an example of a robust authentication mechanism?

   • AMulti-factor authentication (MFA)
   • BRelying solely on IP address filtering
   • CStoring passwords in plaintext in the database
   • DUsing a simple password that is easy to remember
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company exposes a REST API for its mobile app. The API currently has no authentication and is being abused by bots. The team needs to ensure that only legitimate users can access the API and that the API is not overwhelmed. Which two controls should be implemented together?

   • AUse a static API key embedded in the mobile app and increase server capacity.
   • BImplement IP-based allowlisting and disable rate limiting to avoid false positives.
   • CImplement OAuth 2.0 with short-lived access tokens and apply rate limiting per user.
   • DRequire users to enter a CAPTCHA on every API call.
   Reveal Solution Discussion Select an answer first