Application Security CCISO Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A multinational corporation has multiple business units that develop software independently. The CISO wants to implement an application security governance program that ensures compliance with internal policies and industry regulations, but also wants to avoid slowing down development. The business units have different risk appetites and development methodologies. Which governance approach is the most effective?

   • ACreate a single, detailed security standard that all business units must follow exactly, regardless of their methodology.
   • BEstablish a centralized security policy with mandatory minimum standards, and allow business units to implement additional controls based on their risk assessment.
   • COutsource all application security to a third-party vendor and have them enforce a uniform standard.
   • DLet each business unit define its own security policies and report to the CISO annually.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the purpose of application security governance?

   • ATo purchase security tools for the development team
   • BTo hire security personnel for each development team
   • CTo perform penetration testing on all applications
   • DTo establish policies, standards, and procedures that guide secure application development across the organization
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company must comply with data protection regulations that require personal data to be encrypted in transit and at rest. They are deploying a new web application in a public cloud. Which combination of controls is most appropriate?

   • AUse a VPN for all traffic and store data in plain text.
   • BUse TLS only for external traffic and rely on the cloud provider's physical security for data at rest.
   • CUse TLS for all external and internal traffic, and enable encryption at rest for the database and storage services.
   • DEncrypt the database but not the application logs that contain personal data.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the purpose of input validation in application security?

   • ATo log all user actions for auditing purposes
   • BTo authenticate users before they access the application
   • CTo encrypt all data before it is stored in the database
   • DTo ensure that all user input meets expected format and constraints before processing
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   An organization is designing a microservices architecture where each service calls other services. They need to authenticate service-to-service calls without storing shared secrets in code. Which approach is most secure and manageable?

   • AAuthenticate all service calls using the user's session token.
   • BEmbed a static API key in each service's configuration file.
   • CRely on network segmentation to ensure only internal services can communicate.
   • DUse a service mesh with mutual TLS (mTLS) and short-lived certificates for each service.
   Reveal Solution Discussion Select an answer first