Free PECB Certified ISO/IEC 27034 Lead Application Security Implementer Practice Questions

Sample Practice Questions

Try these 10 sample questions from the PECB Certified ISO/IEC 27034 Lead Application Security Implementer practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1An application reveals customer records to users who lack permission to view them. Which information security property is directly compromised?

   1. A.Availability of the records
   2. B.Integrity of the records
   3. C.Confidentiality of the recordsCorrect answer: C
   4. D.Authenticity of the records

   Explanation: NIST describes confidentiality as the "property that information is not made available or disclosed to unauthorized individuals, entities, or processes". The unauthorized disclosure directly compromises confidentiality; the facts do not establish alteration, unavailability, or impersonation.

   Reference: NIST Computer Security Resource Center: Security Glossary — Definitions, NISTIR 8074 Vol. 2, confidentiality

2. 2A company wants to implement its ONF but has not implemented an ISO/IEC 27001 information security management system. What does ISO/IEC 27034-2 say about this situation?

   1. A.The ONF must wait until an ISO/IEC 27001 system is certified.
   2. B.The ONF can be implemented without an ISO/IEC 27001 system.Correct answer: B
   3. C.The ONF must replace the organization's ISMS entirely.
   4. D.The ONF may be implemented only as part of an ISO/IEC 27001 system.

   Explanation: ISO/IEC 27034-2 states that "implementing an information security management system as described in ISO/IEC 27001 is not a requirement for the implementation of this International Standard." The ONF can nevertheless be aligned or integrated with an organization's ISMS.

   Reference: ISO/IEC 27034-2:2015 Organization normative framework — Introduction, Purpose

3. 3A batch job needs to read a defined set of transaction records but never changes them. Its owner can read additional unrelated records. How should the job's access be configured to follow least privilege?

   1. A.Grant read and update access in case the job later changes.
   2. B.Grant administrator access for the duration of every run.
   3. C.Grant read access to the transaction records needed by the job.Correct answer: C
   4. D.Grant access to all records that its owner can read.

   Explanation: NIST defines least privilege as restricting access privileges to "the minimum necessary to accomplish assigned tasks". Read access to the records needed is sufficient for the stated job; update, administrator, and broad owner access exceed its stated needs.

   Reference: NIST Computer Security Resource Center: Least Privilege Glossary — Definitions, CNSSI 4009-2022

4. 4An employee requests access to a sensitive application from a device on the corporate network. How should zero trust policy treat the device's network location?

   1. A.Treat corporate location alone as proof the device is trustworthy.
   2. B.Exclude network location from all policy decisions.
   3. C.Use location as a possible policy attribute without granting trust from it alone.Correct answer: C
   4. D.Grant access only to enterprise-owned devices, regardless of policy.

   Explanation: NIST states that "Network location alone does not imply trust". It also lists "network location, time, reported active attacks, etc." as examples of environmental attributes. Location may inform a policy but is not sufficient by itself to confer trust.

   Reference: NIST SP 800-207 Zero Trust Architecture — Section 2.1, tenet 2

5. 5A manager wants to track rollout of a required application server configuration. Which measure directly indicates implementation progress?

   1. A.Average time needed to remediate detected deviations
   2. B.Percentage of simulated attacks blocked by the configuration
   3. C.Estimated financial impact of a security incident
   4. D.Percentage of servers using the required configurationCorrect answer: D

   Explanation: NIST says "Implementation measures demonstrate the progress of specific controls" and gives the percentage of servers with a standard configuration as an example. The other options address timeliness, effectiveness, or impact.

   Reference: NIST SP 800-55 Volume 1 Measurement Guide for Information Security — Section 3.3.1, Implementation Measures

6. 6An organization hires an independent consultant to audit its own application security processes on its behalf. How is this audit classified?

   1. A.Second-party audit
   2. B.Third-party certification audit
   3. C.First-party auditCorrect answer: C
   4. D.Regulatory enforcement audit

   Explanation: ISO 19011 states "Internal audits, sometimes called first-party audits, are conducted by, or on behalf of, the organization itself." Hiring an external consultant does not change the audit's first-party purpose.

   Reference: ISO 19011:2026 Guidelines for auditing management systems — Clause 3.1, Note 1

7. 7An attacker changes an application's stored account balances without authorization. Which property has been directly affected?

   1. A.Availability
   2. B.IntegrityCorrect answer: B
   3. C.Confidentiality
   4. D.Accountability

   Explanation: NIST describes integrity as the "property of protecting the accuracy and completeness of assets". Unauthorized changes to balances undermine their accuracy; the stated event does not establish loss of access, disclosure, or inability to attribute actions.

   Reference: NIST Computer Security Resource Center: Security Glossary — Definitions, NISTIR 8074 Vol. 2, integrity

8. 8An application is moved to a different technological infrastructure. What should the security planning team recognize about its earlier security assessment?

   1. A.The earlier assessment remains sufficient because the purpose is unchanged.
   2. B.The new context may change requirements and the targeted trust level.Correct answer: B
   3. C.The earlier assessment needs review only when source code changes.
   4. D.The existing controls automatically remain sufficient in the new context.

   Explanation: ISO/IEC 27034-1 states that when the technological infrastructure changes, "these new contexts might impact the security requirements and the Targeted Level of Trust." Existing controls might no longer address the new requirements adequately.

   Reference: ISO/IEC 27034-1:2011 Overview and concepts — Introduction, 0.4.2, Application security context

9. 9A payment application must require two different authorized people to prepare and approve a disbursement. Which control arrangement enforces that separation?

   1. A.Grant one user both actions but record each action in a log.
   2. B.Require distinct users for the preparation and approval actions.Correct answer: B
   3. C.Require two approvals from the same authorized user.
   4. D.Rotate the assigned role while allowing the same user to complete both actions.

   Explanation: NIST explains separation of duties as the principle "that no user should be given enough privileges to misuse the system on their own" and illustrates a two-person rule requiring a different second user. Logging or duplicate approvals by one person do not provide the stated separation; read access does not perform the workflow.

   Reference: NIST Computer Security Resource Center: Separation of Duty Glossary — Definitions, NIST SP 800-192

10. 10A team is deciding which containers should share a host kernel. Which grouping supports NIST's recommended defense in depth?

    1. A.Group containers by privilege needs even when sensitivity differs.
    2. B.Group containers by sensitivity alone even when purpose and threat posture differ.
    3. C.Group containers by base image even when their sensitivity differs.
    4. D.Group containers with similar purpose, sensitivity, and threat posture.Correct answer: D

    Explanation: NIST recommends "Only group containers with the same purpose, sensitivity, and threat posture on a single host OS kernel" for additional defense in depth. Registry or download date alone does not address these security differences.

    Reference: NIST SP 800-190 Application Container Security Guide — Executive Summary, container grouping