A large organization has multiple development teams using different frameworks and languages. The CISO wants to establish a consistent approach to application security across all teams. Which governance document should be created first?

A list of recommended security tools for each team to choose from.

A training program for developers on secure coding.

A set of application security standards that define mandatory secure coding requirements and testing thresholds.

A bug bounty program to find vulnerabilities after release.

A mobile health app stores sensitive patient data on the device. The app also syncs data with a cloud backend. The security team is evaluating different data protection strategies. They need to ensure that data at rest on the device is protected if the device is lost or stolen, and that data in transit is protected from eavesdropping. They also want to minimize the risk of data exposure if the app's binary is reverse-engineered. Which combination of controls is the most robust?

Use a hardcoded encryption key in the app code and rely on HTTPS for network security.

Use the platform's hardware-backed keystore to encrypt data at rest, and use TLS with certificate pinning for network communication.

Encrypt data with a key derived from the user's password and use HTTP for faster sync.

Store data in plain text on the device and use a VPN for all network traffic.

What is the primary goal of DevSecOps?

To perform security testing only after the application is deployed

To replace all manual security testing with automated tools

To integrate security practices into the CI/CD pipeline to automate security testing and monitoring

To separate the security team from the development team to reduce conflicts

What is a unique security challenge in mobile applications compared to traditional web applications?

Mobile apps do not require authentication

Mobile apps are immune to injection attacks

Mobile apps often run on devices that may be lost or stolen, increasing the risk of data exposure

Mobile apps cannot use encryption

What is a primary mitigation strategy for the OWASP Top 10 risk 'Broken Access Control'?

Performing regular penetration tests

Implementing server-side authorization checks for every request

Using HTTPS for all communications

Disabling client-side scripting

EC-CouncilCertified Chief Information Security Officer

Domain 4Objective 5

Application Security CCISO Practice Questions (Page 8)

Part of the Information Security Core Competencies domain, which makes up ~33% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~20–33 in this domain), expect 3–4 from this objective — we provide 65 practice questions to prepare you well beyond it. (estimate)

65questions here

13free pages

15concepts

15 Concepts in This Objective

Application Security Fundamentals
Secure Software Development Lifecycle (SSDLC)
Threat Modeling
Secure Coding Practices
Application Security Testing
OWASP Top 10
Authentication and Authorization
Data Protection in Applications
Application Security Controls
API Security
Mobile Application Security
Cloud Application Security
DevSecOps
Application Security Governance
Incident Response for Applications

Questions 36–40

36application · medium
A large organization has multiple development teams using different frameworks and languages. The CISO wants to establish a consistent approach to application security across all teams. Which governance document should be created first?
Select an answer first
37expert · hard
A mobile health app stores sensitive patient data on the device. The app also syncs data with a cloud backend. The security team is evaluating different data protection strategies. They need to ensure that data at rest on the device is protected if the device is lost or stolen, and that data in transit is protected from eavesdropping. They also want to minimize the risk of data exposure if the app's binary is reverse-engineered. Which combination of controls is the most robust?
Select an answer first
38foundation · easy
What is the primary goal of DevSecOps?
Select an answer first
39foundation · easy
What is a unique security challenge in mobile applications compared to traditional web applications?
Select an answer first
40foundation · easy
What is a primary mitigation strategy for the OWASP Top 10 risk 'Broken Access Control'?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.