A company stores customer payment card data in a database. The security team wants to ensure that even if the database is compromised, the data is unreadable. Which control is most effective?

Use a database firewall to block external connections

Apply input validation to all database queries

Encrypt the data at rest using strong encryption

What is a key characteristic of Static Application Security Testing (SAST)?

It tests the application while it is running to find runtime vulnerabilities

It analyzes source code without executing the application

It monitors production traffic to detect attacks in real time

It involves manually exploiting the application to gain unauthorized access

A development team is fixing a critical vulnerability in a web application where user-supplied search terms are concatenated directly into SQL queries. The team wants a solution that addresses the root cause without requiring changes to the database schema. Which approach should they implement?

Disable error messages that reveal database details

Encode all user input with HTML entity encoding before query execution

Use parameterized queries for all database access

Add a Web Application Firewall (WAF) rule to block suspicious keywords

A developer is writing a web form that accepts user comments and displays them on a public page. The application previously suffered a stored XSS attack. Which secure coding practice should be applied to prevent recurrence?

Encode all user-generated content before rendering it in HTML

Use a blacklist to remove script tags from input

Store comments in a separate database

Disable JavaScript in the browser

What is the primary difference between authentication and authorization?

Authentication is used only for external users; authorization is used for internal users

Authentication grants access; authorization verifies identity

Authentication is a one-time process; authorization is performed on every request

Authentication verifies identity; authorization determines what an authenticated user is allowed to do

EC-CouncilCertified Cybersecurity Technician

Domain 3Objective 2

Application Security CCT Practice Questions (Page 10)

Part of the Security Assessment and Application Security domain, which makes up ~9% of our current practice bank.

51questions here

11free pages

10concepts

Questions 46–50

46application · medium
A company stores customer payment card data in a database. The security team wants to ensure that even if the database is compromised, the data is unreadable. Which control is most effective?
Select an answer first
47foundation · easy
What is a key characteristic of Static Application Security Testing (SAST)?
Select an answer first
48application · medium
A development team is fixing a critical vulnerability in a web application where user-supplied search terms are concatenated directly into SQL queries. The team wants a solution that addresses the root cause without requiring changes to the database schema. Which approach should they implement?
Select an answer first
49application · medium
A developer is writing a web form that accepts user comments and displays them on a public page. The application previously suffered a stored XSS attack. Which secure coding practice should be applied to prevent recurrence?
Select an answer first
50foundation · easy
What is the primary difference between authentication and authorization?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCT” is a trademark of its owner, used for identification only.