Application Security CCT Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company is deploying a web application to a cloud environment. The security team requires that all sensitive data be encrypted in transit and at rest, and that the application be protected against common web attacks. The team also wants to minimize the risk of misconfiguration. Which combination of controls is most effective?

   • AEncrypt the database and rely on network firewalls
   • BEnforce TLS, enable encryption at rest, and deploy a WAF
   • CUse a VPN for all client connections and disable TLS
   • DImplement strong password policies and use a CDN
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security team is planning to test a web application for vulnerabilities. The application is in production and cannot be taken offline. The team wants to identify as many vulnerabilities as possible without causing service disruption. Which testing approach is most appropriate?

   • ARun an active DAST scan against the production application with no safeguards.
   • BRun a SAST scan directly on the production server's source code.
   • CRun a DAST scan against a staging copy of the application that mirrors the production environment.
   • DSkip testing and rely on the WAF to protect the application.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company's web application is compromised. The incident response team discovers that the attacker exploited a SQL injection vulnerability to exfiltrate customer data. The team needs to respond while preserving evidence for a potential legal investigation. Which sequence of actions is most appropriate?

   • ADelete the attacker's files and then change all passwords.
   • BTake a forensic image of the affected server, then isolate it from the network, and then analyze the image for indicators of compromise.
   • CImmediately shut down the server and then restore from backup.
   • DPatch the SQL injection vulnerability and then notify law enforcement.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which mechanism is commonly used to maintain a user's authenticated state across multiple HTTP requests?

   • AIP address verification
   • BHTTP headers with user passwords
   • CClient-side certificates only
   • DSession tokens or cookies
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security team is planning to test a web application for vulnerabilities. They have limited time and budget. They want to identify as many exploitable vulnerabilities as possible, including business logic flaws. Which testing strategy is most effective?

   • AUse only automated DAST
   • BPerform only a threat modeling exercise
   • CCombine automated DAST with manual penetration testing
   • DUse only automated SAST
   Reveal Solution Discussion Select an answer first