Application Security CCISO Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A DevOps team is implementing a DevSecOps pipeline for a containerized application. The team wants to automate security checks without slowing down the release cycle. They have a CI/CD pipeline that builds containers, runs unit tests, and deploys to a staging environment. The security team requires that container images are scanned for known vulnerabilities before deployment, and that runtime security is monitored. Which approach best balances security and speed?

   • AUse a manual security review before every deployment and skip automated scanning to save time.
   • BScan container images in the CI pipeline and fail the build on critical vulnerabilities; use a runtime security agent in staging and production.
   • CRun DAST against the running containers in staging and block all traffic if any vulnerability is found.
   • DScan container images only in production and rely on the orchestrator's built-in security features.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company is building a public API that allows third-party partners to access customer order data. They need to ensure that each partner can only access their own customers' data. Which combination of controls best addresses this requirement?

   • AImplement rate limiting only, assuming that partners will not misuse the API.
   • BUse a shared API key for all partners and rely on the network firewall to restrict access.
   • CIssue each partner a unique API key and enforce object-level authorization checks in the API logic.
   • DRequire partners to send their customer's social security number as a query parameter to identify the data.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which technique is used to protect sensitive data at rest in a database?

   • AHashing
   • BTokenization
   • CEncryption
   • DData masking
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which practice is recommended for securely storing sensitive data on a mobile device?

   • AHardcoding encryption keys in the app's source code
   • BStoring sensitive data in plaintext in the app's local database
   • CRelying on the device's default settings without additional controls
   • DUsing the platform's secure storage APIs, such as Keychain or Keystore
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company is developing a new e-commerce application that processes payments. The security team is conducting threat modeling and has identified that an attacker could tamper with the price of an item by intercepting and modifying the request between the client and the server. The team wants to prioritize this threat based on its likelihood and impact. Which threat modeling approach should they use?

   • AUse OWASP Top 10 to classify the threat as A01:2021-Broken Access Control, then implement a WAF.
   • BUse attack trees to model the attack, then assign a random priority based on the team's intuition.
   • CUse PASTA to create a data flow diagram, then skip the risk rating because the threat is obvious.
   • DUse STRIDE to categorize the threat as Tampering, then rate its risk using DREAD.
   Reveal Solution Discussion Select an answer first