Application Security CCISO Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which security control is used to prevent session hijacking?

   • AInput validation
   • BSession management controls such as secure session IDs and timeouts
   • CData masking
   • DOutput encoding
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A healthcare organization is exposing a REST API to third-party partners. The API handles protected health information (PHI). The organization requires that each partner authenticate with individual credentials, that each partner can only access the specific data elements they are authorized to see, and that all API calls are logged for audit. Which combination of controls should the organization implement?

   • AA shared API key for all partners, and role-based access control (RBAC) based on the partner's IP address.
   • BBasic authentication with each partner's username and password, and a single role for all partners.
   • CJSON Web Tokens (JWT) signed with a shared secret, and authorization based on the token's 'iss' claim only.
   • DOAuth 2.0 with scopes for each partner, and attribute-based access control (ABAC) on the API resources.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A web application has a session management flaw where session IDs are predictable. The security team must fix this without breaking existing user sessions. Which approach is most effective?

   • AGenerate session IDs using a cryptographically secure random number generator and enforce session expiration.
   • BIncrease the session timeout to 24 hours to reduce the need for new IDs.
   • CUse the user's IP address as the session ID.
   • DEncode the session ID using Base64 to make it harder to guess.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is the primary purpose of application security within the software development lifecycle?

   • ATo ensure applications are free from all possible vulnerabilities before release
   • BTo perform a single security review after the application is fully developed
   • CTo ensure the application meets functional requirements and performs efficiently
   • DTo identify, fix, and prevent security vulnerabilities throughout the entire software development lifecycle
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A mobile banking app stores a user's account number and a security question answer on the device. The security team requires that the account number be retrievable by the app for display, but the security answer should only be used for verification and never stored in a reversible form. Which storage approach should the app use?

   • AStore the account number in plain text and encrypt the security answer with a hardcoded key.
   • BEncrypt the account number with a key in the device keystore, and store a salted hash of the security answer.
   • CHash the account number and store the security answer in plain text.
   • DUse the same encryption key for both the account number and the security answer, and store the key in shared preferences.
   Reveal Solution Discussion Select an answer first