CompTIA SecurityX Practice Questions: Application Security

9 free, exam-style CompTIA SecurityX (CAS-005) practice questions covering Application Security, each with the correct answer and an explanation. Start a timed exam below, or scroll on to read through the questions.

🧠

Mini Exam

25 Questions · 50 minutes

Start Quiz 🚀
🏆

Mock SecurityX Exam

85 Questions · 165 minutes

Start Quiz 🚀
📅

Daily Quiz

10 Questions · 20 minutes

Start Quiz 🚀
🎯

Standard Practice

50 Questions · 100 minutes

Start Quiz 🚀

Application Security practice questions

Answers and explanations are shown. Take the timed exam above to test yourself first.

Q1. Which of the following is MOST important when securing API gateways?

  • A.Disabling rate limiting
  • B.JWT validation and strict authentication✓ Correct
  • C.Hardcoded API keys
  • D.No logging
Explanation: API gateways must validate tokens and enforce access controls. Learn more.

Q2. Which of the following is a key security control for microservices architecture?

  • A.Shared service accounts
  • B.Service-to-service authentication and encryption✓ Correct
  • C.Disabled logging
  • D.No network segmentation
Explanation: Microservices require strict authentication between services. Learn more.

Q3. What is the PRIMARY security benefit of using OpenID Connect (OIDC) over SAML?

  • A.More complex implementation
  • B.RESTful JSON-based protocol✓ Correct
  • C.Disabled authentication
  • D.No encryption
Explanation: OIDC is more modern and web-friendly than SAML. Learn more.

Q4. What is the PRIMARY security benefit of using WebAssembly (Wasm) sandboxing?

  • A.Unrestricted system access
  • B.Isolated execution environment for untrusted code✓ Correct
  • C.Disabled memory protection
  • D.No process isolation
Explanation: Wasm provides secure sandboxing for web applications. Learn more.

Q5. Which technique is used to prevent SQL injection attacks?

  • A.Input validation✓ Correct
  • B.MAC filtering
  • C.Port security
  • D.ARP spoofing
Explanation: Input validation ensures only expected data formats are processed. Learn more.

Q6. Which of the following is a critical component of a secure DevOps pipeline?

  • A.Manual code reviews
  • B.Static application security testing (SAST)✓ Correct
  • C.Disabling logging
  • D.Using default passwords
Explanation: SAST identifies vulnerabilities early in development. Learn more.

Q7. Which technique mitigates SQL injection attacks?

  • A.Input validation✓ Correct
  • B.MAC filtering
  • C.Disk encryption
  • D.Log rotation
Explanation: Input validation and parameterized queries prevent SQLi. Learn more.

Q8. Which secure development control is most useful early in the coding phase to find insecure functions?

  • A.SAST✓ Correct
  • B.DDoS scrubbing
  • C.Cold site activation
  • D.Tape rotation
Explanation: Static application security testing analyzes source or compiled code before deployment and can catch issues early. Learn more.

Q9. Which architecture component terminates and inspects API calls for authentication, authorization, and throttling?

  • A.API gateway✓ Correct
  • B.Layer 1 repeater
  • C.Print server
  • D.DHCP relay only
Explanation: API gateways can centralize authentication, authorization, rate limiting, logging, and request validation. Learn more.

More CompTIA SecurityX practice topics

Keep studying CompTIA SecurityX

Full CompTIA SecurityX practice exam · CompTIA SecurityX study guide · All CompTIA practice questions

Last updated