A company is integrating two internal systems. System A needs to send a large batch of data to System B nightly. System B only accepts XML over HTTP POST. System A currently uses RESTful APIs with JSON. What is the most efficient way to achieve the integration while minimizing changes to System B?

Change System B to accept JSON instead of XML

Modify System A to send JSON over HTTP POST to System B

Create a middleware adapter that converts JSON to XML and forwards it via HTTP POST

Use FTP to transfer the data file directly

A web application allows users to submit comments that are displayed to other users. The development team wants to prevent stored XSS attacks while preserving the ability to use basic HTML formatting like bold and italics. Which approach is most effective?

Use an allowlist of safe HTML tags and encode all other characters on output

Disable JavaScript in the browser for the application

Store user input as-is and rely on Content Security Policy (CSP) to block scripts

Strip all HTML tags from user input before storing

A company's web application allows users to transfer money between accounts. A security analyst wants to prevent CSRF attacks. Which control is most effective?

Set the SameSite attribute on session cookies to Lax or Strict.

Require the user to re-enter their password for every transfer.

Include a unique, unpredictable CSRF token in a hidden form field and validate it on the server for every state-changing request.

Use a CAPTCHA on the transfer form.

A web application uses cookies to maintain user sessions. After a security review, the team wants to reduce the risk of session hijacking via cross-site scripting. Which configuration should they implement?

Store session data in a cookie instead of server-side

Set the Secure flag on session cookies

Set the HttpOnly flag on session cookies

EC-CouncilSOC Essentials

Domain 1Objective 5

Web Application Fundamentals SCE Practice Questions (Page 4)

Part of the Computer Network and Security Fundamentals domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–13 in this domain), expect 1–2 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

8concepts

Questions 16–20

16application · easy
A development team is choosing a technology stack for a new web application that requires real-time updates and heavy server-side processing. They need a language that runs on the server and can handle concurrent connections efficiently. Which option is a server-side technology?
Select an answer first
17expert · hard
A company is integrating two internal systems. System A needs to send a large batch of data to System B nightly. System B only accepts XML over HTTP POST. System A currently uses RESTful APIs with JSON. What is the most efficient way to achieve the integration while minimizing changes to System B?
Select an answer first
18expert · hard
A web application allows users to submit comments that are displayed to other users. The development team wants to prevent stored XSS attacks while preserving the ability to use basic HTML formatting like bold and italics. Which approach is most effective?
Select an answer first
19application · medium
A company's web application allows users to transfer money between accounts. A security analyst wants to prevent CSRF attacks. Which control is most effective?
Select an answer first
20application · medium
A web application uses cookies to maintain user sessions. After a security review, the team wants to reduce the risk of session hijacking via cross-site scripting. Which configuration should they implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.