What is a key security best practice for applications deployed in a cloud environment?

Disabling all logging to reduce the attack surface

Storing all data in a single region to simplify management

Using identity and access management (IAM) to control access to cloud resources

Using the same credentials for all cloud services

What is the primary goal of threat modeling in application security?

To write secure code by following coding standards

To identify and prioritize potential threats to an application

To ensure the application meets performance requirements

To test the application for vulnerabilities after deployment

A CISO wants to implement DevSecOps but faces resistance from developers who say security testing slows down the pipeline. Which strategy best addresses this concern while maintaining security?

Run fast SAST scans on every commit and reserve slower DAST scans for nightly builds or release candidates.

Require developers to run security tests manually on their local machines.

Remove all security testing from the pipeline to speed up development.

Run all security tests only after the release is deployed to production.

EC-CouncilCertified Chief Information Security Officer

Domain 4Objective 5

Application Security CCISO Practice Questions (Page 4)

Part of the Information Security Core Competencies domain, which makes up ~33% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~20–33 in this domain), expect 3–4 from this objective — we provide 65 practice questions to prepare you well beyond it. (estimate)

65questions here

13free pages

15concepts

15 Concepts in This Objective

Application Security Fundamentals
Secure Software Development Lifecycle (SSDLC)
Threat Modeling
Secure Coding Practices
Application Security Testing
OWASP Top 10
Authentication and Authorization
Data Protection in Applications
Application Security Controls
API Security
Mobile Application Security
Cloud Application Security
DevSecOps
Application Security Governance
Incident Response for Applications

Questions 16–20

16foundation · easy
Which testing method is most appropriate for identifying vulnerabilities in a running web application from an external perspective?
Select an answer first
17foundation · easy
What is a key security best practice for applications deployed in a cloud environment?
Select an answer first
18foundation · easy
What is the primary goal of threat modeling in application security?
Select an answer first
19foundation · easy
What is the first step in an application security incident response plan?
Select an answer first
20expert · hard
A CISO wants to implement DevSecOps but faces resistance from developers who say security testing slows down the pipeline. Which strategy best addresses this concern while maintaining security?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.

Application Security CCISO Practice Questions (Page 4)

Questions 16–20

Which testing method is most appropriate for identifying vulnerabilities in a running web application from an external perspective?

What is a key security best practice for applications deployed in a cloud environment?

What is the primary goal of threat modeling in application security?

What is the first step in an application security incident response plan?

A CISO wants to implement DevSecOps but faces resistance from developers who say security testing slows down the pipeline. Which strategy best addresses this concern while maintaining security?

Keep studying — Information Security Core Competencies