What is the primary role of a Web Application Firewall (WAF)?

To filter and monitor HTTP traffic between a web application and the internet

To encrypt all data stored in the application's database

To scan source code for vulnerabilities during development

To manage user authentication and authorization

Which type of attack is a Web Application Firewall (WAF) specifically designed to mitigate?

Distributed denial-of-service (DDoS) attacks at the network layer

SQL injection and cross-site scripting (XSS)

Phishing attacks targeting end users

Malware infections on client devices

An e-commerce site is experiencing a spike in automated attacks that exploit a known SQL injection flaw in a legacy module. The module cannot be patched immediately. The security team wants to reduce risk while the patch is developed. What is the most effective immediate control?

Deploy a WAF with a rule set that blocks SQL injection patterns

Increase the server's logging level

Disable the legacy module's error messages

Move the module to a different server

A web application uses session cookies for authentication. The security team discovers that an attacker can hijack a user's session by intercepting the cookie. The application is accessed over HTTPS. Which additional control is most effective to prevent session hijacking?

Store the session ID in the URL

Disable cookies and use HTTP Basic authentication

Set the Secure and HttpOnly flags on the session cookie

Which security testing method simulates real-world attacks to identify exploitable vulnerabilities in a running application?

Static Application Security Testing (SAST)

Software Composition Analysis (SCA)

Dynamic Application Security Testing (DAST)

EC-CouncilCertified Cybersecurity Technician

Domain 3Objective 2

Application Security CCT Practice Questions (Page 3)

Part of the Security Assessment and Application Security domain, which makes up ~9% of our current practice bank.

51questions here

11free pages

10concepts

Questions 11–15

11foundation · easy
What is the primary role of a Web Application Firewall (WAF)?
Select an answer first
12foundation · easy
Which type of attack is a Web Application Firewall (WAF) specifically designed to mitigate?
Select an answer first
13application · medium
An e-commerce site is experiencing a spike in automated attacks that exploit a known SQL injection flaw in a legacy module. The module cannot be patched immediately. The security team wants to reduce risk while the patch is developed. What is the most effective immediate control?
Select an answer first
14expert · hard
A web application uses session cookies for authentication. The security team discovers that an attacker can hijack a user's session by intercepting the cookie. The application is accessed over HTTPS. Which additional control is most effective to prevent session hijacking?
Select an answer first
15foundation · easy
Which security testing method simulates real-world attacks to identify exploitable vulnerabilities in a running application?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCT” is a trademark of its owner, used for identification only.