Application Security CCISO Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A company is developing a microservices-based application with many internal APIs. The security team wants to automate security testing in the CI/CD pipeline. They have a limited budget and need to choose between SAST, DAST, and IAST. The team wants to catch vulnerabilities as early as possible, but also wants to reduce false positives that slow down development. Which approach is the most balanced?

   • AUse only DAST in production to avoid false positives entirely.
   • BUse only SAST and require developers to manually triage every finding.
   • CIntegrate SAST into the pipeline and use IAST in the test environment to reduce false positives.
   • DUse only IAST in the CI pipeline and skip SAST to save costs.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A software company is adopting DevSecOps and wants to integrate security testing into its CI/CD pipeline. The pipeline currently builds the application, runs unit tests, and deploys to a test environment. The security team wants to automatically block the build if critical vulnerabilities are found, but allow the pipeline to continue for low-severity issues. Which approach best achieves this goal?

   • AAdd a SAST scan step after the build, with a quality gate that fails the pipeline on critical findings.
   • BAdd a DAST scan step before the build, and fail the pipeline on any finding.
   • CAdd a RASP agent to the test environment and configure it to block all requests with suspicious payloads.
   • DAdd a manual security review step after deployment, and document all findings in a spreadsheet.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A company is building a new customer portal that will be accessed by both internal employees and external customers. The portal will integrate with an existing identity provider (IdP) that supports SAML and OAuth 2.0. The security team requires that external customers use multi-factor authentication (MFA), but internal employees already use MFA via the corporate IdP. The portal also exposes a REST API for mobile clients. Which authentication architecture is the most appropriate?

   • AUse OAuth 2.0 with the IdP for both web and mobile clients, and enforce MFA policies on the IdP for all users.
   • BUse basic authentication for the API and SAML for the web portal, with MFA only for internal employees.
   • CUse JWT tokens issued by the portal itself and skip the IdP integration.
   • DUse SAML for web clients and API keys for mobile clients, with MFA only for external customers.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A company's web application was breached through a vulnerability in a third-party library. The incident response team has contained the breach and restored services. The CISO wants to update the incident response plan to better handle similar incidents in the future. The team has identified that the library was outdated and that the application did not have a process for tracking library versions. Which improvement should be prioritized?

   • ADisable all third-party libraries and rewrite the application using only internal code.
   • BAdd a manual step to the incident response plan to check for library updates after every incident.
   • CImplement a software composition analysis (SCA) tool in the CI/CD pipeline to automatically detect vulnerable libraries.
   • DIncrease the frequency of penetration tests to quarterly.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Which of the following is a common method for authenticating API clients?

   • AOutput encoding
   • BInput validation
   • CRate limiting
   • DAPI keys
   Reveal Solution Discussion Select an answer first