An application uses role-based access control (RBAC). A user with the 'viewer' role is able to access an administrative endpoint by manually changing the URL. What is the most likely root cause and fix?

The application lacks server-side authorization checks on the endpoint

The user's browser cache is storing old permissions

The web server is misconfigured to allow directory traversal

The URL is not encrypted with HTTPS

A company is implementing role-based access control (RBAC) for a new application. The application has three roles: User, Manager, and Admin. A Manager should be able to view and edit reports created by users in their department, but not delete them. Admins can do everything. The current implementation allows any authenticated user to edit any report. What is the most effective way to enforce the required access control?

Implement object-level authorization checks in the application logic that verify the user's role and department before allowing edit or delete actions.

Encrypt the reports so only users with the decryption key can view them.

Use a Web Application Firewall to block delete requests from Manager accounts.

Assign the Manager role to all users and rely on the database to restrict access.

A company's web application is defaced and the homepage is replaced with a malicious message. The security team suspects an unpatched plugin was exploited. What is the FIRST step in the incident response process for this application?

Patch the vulnerable plugin and restart the web service.

Isolate the affected application server from the network to prevent further compromise.

Notify law enforcement and the public before taking any technical action.

Rebuild the server from a clean backup immediately.

In the context of the software development lifecycle (SDLC), what is the primary purpose of application security?

To ensure that applications are free from all possible bugs and errors before release

To protect applications from threats and vulnerabilities throughout their lifecycle, from design to deployment and maintenance

To guarantee that applications comply with all international data protection regulations automatically

To ensure that applications are delivered as quickly as possible to meet business deadlines

Which technique is used to protect sensitive data at rest in a database?

Masking the data with random characters

Applying a digital signature to the data

Encrypting the data with a symmetric key

EC-CouncilCertified Cybersecurity Technician

Domain 3Objective 2

Application Security CCT Practice Questions (Page 2)

Part of the Security Assessment and Application Security domain, which makes up ~9% of our current practice bank.

51questions here

11free pages

10concepts

Questions 6–10

6application · medium
An application uses role-based access control (RBAC). A user with the 'viewer' role is able to access an administrative endpoint by manually changing the URL. What is the most likely root cause and fix?
Select an answer first
7expert · hard
A company is implementing role-based access control (RBAC) for a new application. The application has three roles: User, Manager, and Admin. A Manager should be able to view and edit reports created by users in their department, but not delete them. Admins can do everything. The current implementation allows any authenticated user to edit any report. What is the most effective way to enforce the required access control?
Select an answer first
8application · medium
A company's web application is defaced and the homepage is replaced with a malicious message. The security team suspects an unpatched plugin was exploited. What is the FIRST step in the incident response process for this application?
Select an answer first
9foundation · easy
In the context of the software development lifecycle (SDLC), what is the primary purpose of application security?
Select an answer first
10foundation · easy
Which technique is used to protect sensitive data at rest in a database?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCT” is a trademark of its owner, used for identification only.