I85PREP
⌘ K
ISO/IEC 27034 Foundation study materials
ISO/IEC 27034 Foundation study resources

ISO/IEC 27034 Foundation practice questions

One question at a time. Build your ISO/IEC 27034 Foundation understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental concepts and principles of application security and ISO/IEC 27034

ISO/IEC 27034 presents application security primarily as which kind of concept?

  1. A product certification awarded once to a finished software package
  2. A process that begins only after the application is deployed
  3. A property of the application that is achieved and maintained across its lifecycle Correct answer.
  4. A network control applied by the firewall in front of the application

Explanation

ISO/IEC 27034 frames application security as a property of the application itself, established and maintained throughout the lifecycle rather than a one-off label or an external device. Controls, processes and evidence all exist to give confidence that this property is achieved.

Question 2Fundamental concepts and principles of application security and ISO/IEC 27034

In ISO/IEC 27034 terms, what does an Application Security Control (ASC) describe?

  1. A list of employees authorised to approve source code changes
  2. A log format used by intrusion detection sensors
  3. A licence key that unlocks security features in commercial software
  4. A specification of a control that contributes to achieving application security requirements Correct answer.

Explanation

An ASC is a documented specification of a control, including its objective, implementation guidance and verification approach, that helps satisfy application security requirements. ASCs are reusable building blocks selected from a library and tailored to a specific application.

Question 3Fundamental concepts and principles of application security and ISO/IEC 27034

Which statement best captures the relationship between an Application Security Control Library and an individual application?

  1. The library replaces the application's own risk assessment entirely
  2. Each application must implement every control held in the library
  3. The library is only consulted after the application has been retired
  4. The library is a catalogue from which relevant controls are selected and tailored for the application Correct answer.

Explanation

The ASC library is a reusable catalogue of control specifications. For a given application, the organisation selects the controls that address its identified security requirements and tailors them to context; it does not blindly apply all of them or skip risk assessment.

Question 4Fundamental concepts and principles of application security and ISO/IEC 27034

What is the purpose of the Application Security Management Process (ASMP) in ISO/IEC 27034?

  1. To schedule penetration tests performed by external suppliers
  2. To manage application security consistently across the organisation's application portfolio Correct answer.
  3. To define the cryptographic algorithms permitted in an organisation
  4. To record the inventory of physical servers hosting applications

Explanation

The ASMP is the organisation-level process that governs how application security is planned, implemented, verified and maintained across all applications. It provides consistency, roles and oversight rather than prescribing algorithms or individual test schedules.

Question 5Fundamental concepts and principles of application security and ISO/IEC 27034

An organisation wants to state, for a particular application, the level of confidence that its security requirements are met. Which ISO/IEC 27034 concept addresses this?

  1. The Application Security Target Level of Trust Correct answer.
  2. The data retention schedule
  3. The service level agreement for help desk response
  4. The network demarcation point

Explanation

The target level of trust expresses the desired confidence that an application meets its security requirements, and the achieved level of trust records what has actually been demonstrated. Both are central to how ISO/IEC 27034 communicates assurance.

Question 6Fundamental concepts and principles of application security and ISO/IEC 27034

During tailoring, a team finds that a library ASC assumes a central identity provider that the application does not use. What is the most appropriate ISO/IEC 27034-aligned response?

  1. Copy the control into the application's documentation without any change
  2. Implement the control exactly as written even though it cannot work
  3. Adapt the control to the application's context and record the rationale and resulting evidence Correct answer.
  4. Discard the control and accept the associated risk without documentation

Explanation

Tailoring is expected: controls are adapted to the application's environment while preserving the security objective, and the adaptation and its justification should be recorded. This keeps traceability between requirements, selected controls and evidence.

Question 7Fundamental concepts and principles of application security and ISO/IEC 27034

Which pairing correctly describes two distinct ISO/IEC 27034 concepts?

  1. ASMP is application-specific evidence; ASC is organisation-wide governance
  2. ASC is a control specification; the level of trust is a statement of assurance about the application Correct answer.
  3. Level of trust is a network topology; ASC is a firewall rule set
  4. ASC library is a testing tool; ASMP is a coding standard

Explanation

An ASC specifies a control and how to implement and verify it, whereas the level of trust expresses assurance that requirements are satisfied. The ASMP is the organisation-level management process, distinct from both.

Question 8Fundamental concepts and principles of application security and ISO/IEC 27034

Why does ISO/IEC 27034 emphasise defining security requirements early in the application lifecycle?

  1. Because requirements can only be written by external auditors
  2. Because security requirements eliminate the need for verification activities
  3. Because later remediation of design flaws is typically more costly and less effective Correct answer.
  4. Because early requirements remove the need for any risk assessment

Explanation

Security requirements drive which controls are selected and how the application is designed and verified. Addressing them early avoids expensive rework, since architectural flaws are harder and costlier to fix after deployment.

Question 9Fundamental concepts and principles of application security and ISO/IEC 27034

A team claims an application is secure because it passed a single vulnerability scan before release. How does ISO/IEC 27034 view this claim?

  1. Insufficient, because assurance must be built and maintained across the lifecycle with appropriate evidence Correct answer.
  2. Sufficient, because a scan covers all control objectives
  3. Sufficient, provided the scan was run by a third party
  4. Irrelevant, because scanning has no place in application security

Explanation

A single scan is a point-in-time check and cannot demonstrate that security requirements are met throughout the lifecycle. ISO/IEC 27034 expects ongoing activities and recorded evidence supporting the achieved level of trust.

Question 10Fundamental concepts and principles of application security and ISO/IEC 27034

What role does risk assessment play in the ISO/IEC 27034 approach to application security?

  1. It determines which security requirements and controls are relevant to the application Correct answer.
  2. It is performed only once the application is decommissioned
  3. It is optional and has no influence on control selection
  4. It replaces the need to define a target level of trust

Explanation

Risk assessment identifies threats and impacts that shape the application's security requirements, which in turn guide control selection and the target level of trust. It is an input to decisions, not a substitute for them.

Question 11Fundamental concepts and principles of application security and ISO/IEC 27034

Which artefact provides the traceable link from an application's security requirements to the controls chosen and the evidence produced?

  1. The application security case or related lifecycle records Correct answer.
  2. The office floor plan
  3. The organisation's marketing plan
  4. The payroll register

Explanation

ISO/IEC 27034 relies on records that connect requirements, selected and tailored controls, and verification evidence. This traceability allows an assessor to see why each control exists and what demonstrates its effectiveness.

Question 12Fundamental concepts and principles of application security and ISO/IEC 27034

In ISO/IEC 27034, what distinguishes an organisation's ASC library from the ASCs actually applied to one application?

  1. The applied set must be larger than the library
  2. The library exists only for legacy applications
  3. The library is the reusable organisation-wide set, while the applied set is the tailored subset used for that application Correct answer.
  4. Nothing; they are always identical in content

Explanation

The library holds reusable control specifications maintained at organisation level. For each application, a subset is selected and tailored, so the applied set is normally smaller and context-specific.

Question 13Fundamental concepts and principles of application security and ISO/IEC 27034

Which statement about the relationship between ISO/IEC 27034 and other ISO/IEC 27000-family standards is most accurate?

  1. It conflicts with ISO/IEC 27002 control guidance
  2. It provides application-specific guidance that complements organisation-level information security management Correct answer.
  3. It applies only to organisations without any information security management system
  4. It replaces ISO/IEC 27001 certification for the whole organisation

Explanation

ISO/IEC 27034 focuses on application security and works alongside organisation-level management standards and control guidance. It is not a substitute for an information security management system.

Question 14Fundamental concepts and principles of application security and ISO/IEC 27034

A project selects an ASC for input validation. Which element should the ASC specification include to support later verification?

  1. The expected implementation approach and the means to verify it Correct answer.
  2. The marketing release date of the application
  3. Only the name of the developer responsible
  4. The purchase price of the development tooling

Explanation

An ASC specification describes the control objective, implementation guidance and verification approach so that effectiveness can be demonstrated. Verification criteria are what allow evidence to be produced and assessed.

Question 15Fundamental concepts and principles of application security and ISO/IEC 27034

Which of the following best describes the scope of application security as understood in ISO/IEC 27034?

  1. Only the source code repository
  2. Only the interfaces exposed to external users
  3. Only the production runtime environment of the application
  4. The application across its lifecycle, including requirements, design, development, operation and disposal Correct answer.

Explanation

Application security covers the whole lifecycle rather than a single phase or artefact. Requirements, design, build, operation and eventual disposal all contribute to whether the security property is achieved and maintained.

Question 16Fundamental concepts and principles of application security and ISO/IEC 27034

An auditor asks why a particular control was not applied to an application. Which record best supports a defensible answer?

  1. The developer's personal notes about the control
  2. The vendor's generic product brochure
  3. A verbal statement from the project sponsor
  4. The documented tailoring decision and risk rationale for that application Correct answer.

Explanation

Documented tailoring decisions and risk rationale provide the justification for excluding or adapting a control. Such records make the decision reviewable and show that risk was consciously considered.

Question 17Fundamental concepts and principles of application security and ISO/IEC 27034

Which factor most directly influences the target level of trust set for an application?

  1. The number of developers on the team
  2. The colour scheme of the user interface
  3. The sensitivity of the data handled and the potential impact of compromise Correct answer.
  4. The programming language's popularity ranking

Explanation

The target level of trust reflects how much assurance is warranted, which depends on risk: data sensitivity, threat exposure and business impact. Technical or cosmetic factors are not the primary drivers.

Question 18Fundamental concepts and principles of application security and ISO/IEC 27034

What is the primary reason ISO/IEC 27034 promotes reuse of ASCs across applications?

  1. To reduce effort and improve consistency while still requiring tailoring to context Correct answer.
  2. To eliminate the need for application-specific risk assessment
  3. To guarantee that every application has identical security needs
  4. To prevent developers from documenting their decisions

Explanation

Reusable control specifications save effort and encourage consistent practice, but each application still selects and tailors them according to its own requirements. Reuse does not imply identical security needs.

Question 19Fundamental concepts and principles of application security and ISO/IEC 27034

Which statement about verification activities within the ISO/IEC 27034 approach is correct?

  1. They are performed only by the vendor that supplied the library
  2. They produce evidence that selected controls are implemented and effective Correct answer.
  3. They are unnecessary when a control is widely reused
  4. They replace the need to define security requirements

Explanation

Verification confirms that controls are implemented as intended and achieve their objective, generating evidence that supports the achieved level of trust. Requirements must still be defined, and reuse does not remove the need to verify in context.

Question 20Fundamental concepts and principles of application security and ISO/IEC 27034

How should the ASMP treat applications with different risk profiles across a portfolio?

  1. Scale requirements, controls and assurance activities according to each application's risk Correct answer.
  2. Apply identical controls and assurance effort to every application regardless of risk
  3. Exclude low-risk applications from the process entirely
  4. Delegate all decisions to individual developers without oversight

Explanation

A portfolio-level process should be proportionate: higher-risk applications warrant more stringent requirements and stronger assurance, while lower-risk ones may need less. Uniform treatment wastes effort and ignores differing exposure.

Question 21Fundamental concepts and principles of application security and ISO/IEC 27034

A team argues that because an ASC is listed in the organisation's library, the application automatically satisfies the related requirement. Which critique is most consistent with ISO/IEC 27034?

  1. Correct, since library inclusion proves implementation
  2. Correct, provided the library is approved by the security team
  3. Incorrect, because libraries may never be used for assurance
  4. Incorrect, because selection and effective implementation must still be demonstrated for that application Correct answer.

Explanation

Library membership only means a reusable specification exists. Assurance requires that the control be selected, tailored, implemented and verified for the specific application, with evidence recorded.

Question 22Fundamental concepts and principles of application security and ISO/IEC 27034

Which sequence best reflects the logic linking ISO/IEC 27034 elements for a single application?

  1. Assess risk and define requirements, then select and tailor controls, then verify and record evidence Correct answer.
  2. Select controls, then define requirements, then assess risk
  3. Record evidence, then select controls, then define requirements
  4. Verify controls, then define requirements, then assess risk

Explanation

Risk assessment informs security requirements; requirements drive selection and tailoring of controls; verification then produces evidence of the achieved level of trust. Reversing the order undermines the traceability the standard relies on.

Question 23Fundamental concepts and principles of application security and ISO/IEC 27034

Which situation best illustrates the concept of an achieved level of trust that falls short of the target?

  1. A target was set at a high level, but verification evidence covers only some of the selected controls Correct answer.
  2. A target was set and every selected control was verified with recorded evidence
  3. No target was ever defined for the application
  4. The application was retired before any target was set

Explanation

The achieved level of trust reflects what verification has actually demonstrated. If evidence covers only part of the selected controls, the achieved level is lower than the target and remediation or further verification is needed.

Question 24Fundamental concepts and principles of application security and ISO/IEC 27034

Why does ISO/IEC 27034 separate the specification of a control from its implementation in a particular application?

  1. To allow the same control objective to be realised appropriately in different technical and organisational contexts Correct answer.
  2. To make the library independent of any security requirements
  3. To ensure that implementations never vary between applications
  4. To remove the need for verification evidence

Explanation

Separating specification from implementation lets an organisation define a stable control objective while allowing context-appropriate realisation. This supports reuse and tailoring without losing the link to the underlying requirement.

Question 25Fundamental concepts and principles of application security and ISO/IEC 27034

Which statement best explains why application security is described as a property rather than a discrete project phase?

  1. Because it depends solely on the development methodology chosen
  2. Because it is achieved once and never needs review
  3. Because it must hold true whenever the application operates, requiring maintenance as the application and its environment change Correct answer.
  4. Because it is only relevant during the testing phase

Explanation

A property must remain true over time, so changes to the application, its dependencies and its threat environment require ongoing attention. Treating security as a phase would leave it unmaintained after that phase ends.

Question 26Fundamental concepts and principles of application security and ISO/IEC 27034

In ISO/IEC 27034, what is an Application Security Control (ASC)?

  1. A documented control that specifies how a defined security requirement can be met in an application Correct answer.
  2. A firewall rule set applied at the network perimeter of a data centre
  3. A licence key that unlocks encrypted modules of a commercial application
  4. A contractual clause transferring security liability to a software vendor

Explanation

An ASC is a specification of a control that addresses one or more application security requirements, described in a way that allows it to be selected and reused. It is documentation of what to achieve and how, not a network device configuration or a commercial artefact.

Question 27Fundamental concepts and principles of application security and ISO/IEC 27034

Which term does ISO/IEC 27034 use for the documented set of security-related requirements, controls, evidence and decisions for a specific application throughout its lifecycle?

  1. The Application Security Management Process (ASMP) applied to that application
  2. The Application Security Case for that application Correct answer.
  3. The Application Security and Privacy Plan of the enterprise
  4. The Organisational Security Baseline of the business unit

Explanation

The Application Security Case (ASC case) is the application-specific record that consolidates the target level of trust, selected ASCs, verification results and evidence. It is distinct from the organisation-wide process and from generic baselines.

Question 28Fundamental concepts and principles of application security and ISO/IEC 27034

What does the 'level of trust' represent in ISO/IEC 27034?

  1. The number of security certifications held by the development team
  2. The percentage of code covered by automated unit tests
  3. The encryption strength of the transport layer used by the application
  4. The confidence that an application meets its stated security requirements to a defined degree Correct answer.

Explanation

Level of trust expresses how much confidence can be placed that an application satisfies its security requirements, based on the rigour of the controls and the evidence gathered. It is a graded measure of assurance, not a technical metric such as cipher strength or test coverage.

Question 29Fundamental concepts and principles of application security and ISO/IEC 27034

Which statement correctly distinguishes a target level of trust from an achieved level of trust?

  1. The target is a numeric score, while the achieved level is always expressed as a pass or fail
  2. The target is set after verification, while the achieved level is fixed at project initiation
  3. The target applies only to purchased software, while the achieved level applies only to in-house code
  4. The target is the assurance the organisation decides is needed, while the achieved level is what evidence demonstrates Correct answer.

Explanation

The target level of trust is chosen up front based on risk and business needs, and the achieved level is determined from the evidence produced by applying and verifying controls. Comparing the two reveals whether the application is acceptable.

Question 30Fundamental concepts and principles of application security and ISO/IEC 27034

How does ISO/IEC 27034 treat application security relative to the software development lifecycle?

  1. It treats security as an activity performed only by the operations team after deployment
  2. It treats security as a documentation exercise completed during procurement
  3. It treats security as a concern that must be addressed continuously across all lifecycle phases Correct answer.
  4. It treats security as a gate that occurs once, immediately before production release

Explanation

ISO/IEC 27034 frames application security as an ongoing property that must be planned, built, verified and maintained throughout the lifecycle. Treating it as a single gate or a post-deployment task leaves gaps as requirements and threats change.

Question 31Fundamental concepts and principles of application security and ISO/IEC 27034

In the ISO/IEC 27034 framework, what is the primary purpose of the organisation-level Application Security Management Process (ASMP)?

  1. To replace the organisation's overall information security management system
  2. To certify individual developers against a competence scheme
  3. To provide a ready-made source code scanner for development teams
  4. To define how the organisation governs, tailors and verifies application security across its portfolio Correct answer.

Explanation

The ASMP is the governing process that establishes how application security is managed organisation-wide, including roles, risk-based tailoring and verification. It complements rather than replaces the broader ISMS and does not supply tools or personal certifications.

Question 32Fundamental concepts and principles of application security and ISO/IEC 27034

Which element of an ASC specification most directly enables an auditor to confirm that the control was implemented as intended?

  1. The name of the developer who first proposed the control
  2. The verification method and expected evidence associated with the control Correct answer.
  3. The marketing description of the application's user-facing features
  4. The commercial price of the tooling used to build the application

Explanation

An ASC specification states how conformity with the control can be verified and what evidence should result, which is what allows later audit. Names, prices and marketing text do not demonstrate that the control behaves as specified.

Question 33Fundamental concepts and principles of application security and ISO/IEC 27034

What is the role of the organisation's ASC library within ISO/IEC 27034?

  1. It is the audit log of administrative actions taken on the identity management system
  2. It is a register of security incidents that have affected production applications
  3. It stores the source code of all applications so controls can be copied between them
  4. It is a catalogue of reusable control specifications from which application-specific selections are made Correct answer.

Explanation

The ASC library holds documented, reusable control specifications that teams can select and tailor for particular applications. It is a catalogue of specifications, not a code repository, incident register or system audit log.

Question 34Fundamental concepts and principles of application security and ISO/IEC 27034

A team applies an ASC from the library to a new application without adjusting it to the application's technology stack. What does ISO/IEC 27034 suggest is the likely consequence?

  1. The control may not fit the context and its conformity may be unverifiable Correct answer.
  2. The application is exempt from further verification activities
  3. The target level of trust is automatically lowered to match the reuse
  4. The control automatically becomes more effective because it is reused

Explanation

Reuse is expected to be accompanied by tailoring to the application's context, including its architecture and technology. Applying a specification unchanged can leave it misaligned with the environment and hard to verify.

Question 35Fundamental concepts and principles of application security and ISO/IEC 27034

Which of the following best describes the relationship between application security requirements and ASCs?

  1. Requirements state what must be achieved; ASCs describe controls that can achieve them Correct answer.
  2. Requirements and ASCs are synonyms in ISO/IEC 27034 and are used interchangeably
  3. Each ASC replaces the need to define any security requirements
  4. ASCs are defined first and requirements are derived from whatever controls exist

Explanation

Requirements express the security outcomes an application must meet, while ASCs are candidate controls that can satisfy those outcomes. Keeping the two distinct allows different controls to be chosen for the same requirement.

Question 36Fundamental concepts and principles of application security and ISO/IEC 27034

An organisation operates applications with very different exposure: an internet-facing payment service and an internal reporting tool. How should the ASMP handle them?

  1. Exclude internal applications from the process entirely to reduce effort
  2. Apply the same target level of trust to both so the process stays consistent
  3. Allow risk-based differentiation of target levels of trust and verification rigour Correct answer.
  4. Apply the highest target level of trust to every application regardless of exposure

Explanation

The ASMP should permit risk-based tailoring so that higher exposure and impact justify higher target levels of trust and more rigorous verification. Uniform treatment either over-controls low-risk systems or under-controls high-risk ones.

Question 37Fundamental concepts and principles of application security and ISO/IEC 27034

Which statement about the concept of assurance in ISO/IEC 27034 is most accurate?

  1. Assurance is established once and never revisited during operation
  2. Assurance is equivalent to the absence of reported security incidents
  3. Assurance is grounded in evidence that controls are appropriate and effective for the application Correct answer.
  4. Assurance grows with the quantity of documentation produced, regardless of its relevance

Explanation

Assurance depends on relevant evidence showing that selected controls are suitable and actually work for the application. Volume of documentation, one-off assessment or mere absence of incidents does not by itself provide that grounding.

Question 38Fundamental concepts and principles of application security and ISO/IEC 27034

What does ISO/IEC 27034 mean by 'tailoring' an ASC?

  1. Adapting a generic control specification to the specific application's context and constraints Correct answer.
  2. Translating the ASC documentation into the developer's native language
  3. Renaming the ASC so it matches the application's naming convention
  4. Deleting the ASC from the library when it is no longer needed

Explanation

Tailoring is the deliberate adaptation of a reusable specification so it fits the application's architecture, technology and risk context. It is substantive adjustment, not deletion, translation or cosmetic renaming.

Question 39Fundamental concepts and principles of application security and ISO/IEC 27034

A development team wants to demonstrate that its application reaches the agreed level of trust. Which combination of activities best supports that claim under ISO/IEC 27034?

  1. Publishing a security policy on the corporate intranet and holding an annual awareness session
  2. Completing a threat modelling workshop without recording any outputs
  3. Selecting ASCs, implementing them, and verifying them with recorded evidence against the target Correct answer.
  4. Purchasing a commercial security product and listing it in the procurement register

Explanation

Reaching a level of trust requires selecting appropriate controls, implementing them in the application and verifying them with evidence that is retained. Policies, purchases and unrecorded workshops do not demonstrate that the application itself meets the target.

Question 40Fundamental concepts and principles of application security and ISO/IEC 27034

Which of the following is an example of an application security requirement rather than an ASC?

  1. The application shall store passwords using a salted adaptive hash function
  2. The application shall prevent injection attacks from reaching persistent storage Correct answer.
  3. The application shall use parameterised queries for all database access
  4. The application shall validate all user-supplied input against an allow-list before processing

Explanation

A requirement states the security outcome to be achieved, such as preventing injection from reaching stored data. The other options describe specific technical controls that could be selected to satisfy such an outcome.

Question 41Fundamental concepts and principles of application security and ISO/IEC 27034

Why does ISO/IEC 27034 place emphasis on the application's business context when determining security needs?

  1. Because business stakeholders are responsible for writing all secure code
  2. Because commercial applications are always exempt from security requirements
  3. Because the value of the application and the harm from its failure shape the required level of trust Correct answer.
  4. Because business context determines which programming language must be used

Explanation

The business context clarifies what the application supports and what harm would follow from its compromise, which drives how much assurance is warranted. It does not dictate language choice, grant exemptions or shift coding duties to business users.

Question 42Fundamental concepts and principles of application security and ISO/IEC 27034

How does ISO/IEC 27034 relate to the broader ISO/IEC 27000 family of standards?

  1. It replaces ISO/IEC 27001 by providing a complete certification scheme for applications
  2. It provides application-specific guidance that complements organisation-level information security management Correct answer.
  3. It is a technical protocol standard governing encrypted network transport
  4. It applies only to organisations that have no existing information security management system

Explanation

ISO/IEC 27034 offers application-focused guidance that sits alongside and supports organisation-level management standards. It is neither a replacement certification scheme nor a network protocol specification.

Question 43Fundamental concepts and principles of application security and ISO/IEC 27034

An application's achieved level of trust is lower than its target. What is the most appropriate interpretation under ISO/IEC 27034?

  1. The target level of trust should be silently rewritten to match the achieved level
  2. The application should be removed from the security case to avoid recording the gap
  3. The application is fully acceptable because a level of trust was measured
  4. The shortfall must be addressed through additional controls or accepted through a documented risk decision Correct answer.

Explanation

A gap between target and achieved levels signals that the application does not yet provide the intended assurance. The organisation should either close the gap with further controls and evidence or formally accept the residual risk.

Question 44Fundamental concepts and principles of application security and ISO/IEC 27034

Which characteristic most clearly makes an ASC suitable for inclusion in an organisation-wide library?

  1. It is described generically enough to be understood and adapted across multiple applications Correct answer.
  2. It depends on a single developer who alone understands how it works
  3. It contains confidential details that cannot be shared beyond one project team
  4. It is written specifically for one application and references that application's internal code names

Explanation

Library entries are meant to be reused, so they must be expressed generically and understandably enough for other teams to tailor them. Application-specific references, single-person dependency or non-shareable content undermine reuse.

Question 45Fundamental concepts and principles of application security and ISO/IEC 27034

What distinguishes verification from validation in the context of application security controls?

  1. Verification applies to purchased software; validation applies to custom software
  2. Verification is optional; validation is mandatory for every application
  3. Verification confirms the control was built as specified; validation confirms it addresses the intended security need Correct answer.
  4. Verification is performed only by external auditors; validation is performed only by developers

Explanation

Verification checks conformity with the specification, while validation checks that the control actually meets the real security need in context. The distinction is about what is being confirmed, not who performs it or how the software was sourced.

Question 46Fundamental concepts and principles of application security and ISO/IEC 27034

Which outcome best indicates that an application security control has been effectively applied?

  1. The control appears in a design document but no implementation was attempted
  2. The control is implemented and evidence shows it behaves as specified in the running application Correct answer.
  3. The control was copied into the ASC library from an external source
  4. The control was discussed in a meeting and the minutes were filed

Explanation

Effectiveness is shown when the control is actually implemented and evidence confirms the specified behaviour in the application. Documentation, discussion or copying a specification only shows intent or reference material.

Question 47Fundamental concepts and principles of application security and ISO/IEC 27034

A team proposes measuring application security solely by counting the number of ASCs applied. Why is this insufficient under ISO/IEC 27034?

  1. Because ASCs cannot be counted once they are tailored
  2. Because only ASCs from external sources are valid and these are rarely available
  3. Because the relevance and effectiveness of the selected controls matter more than their quantity Correct answer.
  4. Because counting is only permitted after the application is retired

Explanation

The framework is concerned with whether the right controls are applied and shown to work for the application's requirements. A high count of irrelevant or ineffective controls provides little assurance.

Question 48Fundamental concepts and principles of application security and ISO/IEC 27034

What is the purpose of recording the rationale for selecting particular ASCs for an application?

  1. To satisfy a requirement that every application use at least ten controls
  2. To ensure that no other application can reuse the same controls
  3. To provide traceability from requirements and risk to the chosen controls Correct answer.
  4. To allow developers to skip verification of the selected controls

Explanation

Recording why controls were chosen creates traceability from the application's requirements and risk assessment to the implemented controls. It supports audit and change management, and it does not remove the need for verification or block reuse.

Question 49Fundamental concepts and principles of application security and ISO/IEC 27034

Which situation best illustrates a failure to maintain an application's security case over time?

  1. A new ASC is added to the library after a review of emerging threats
  2. A verification activity is repeated after a significant code change
  3. The application is migrated to a new platform, but the security case still describes the old architecture and evidence Correct answer.
  4. A target level of trust is raised after the application begins handling sensitive data

Explanation

The security case must reflect the application as it currently is, so a platform migration that leaves the case describing an old architecture creates a stale, misleading record. The other options show appropriate maintenance of the case.

Question 50Fundamental concepts and principles of application security and ISO/IEC 27034

How should the concept of defence in depth be reflected when selecting ASCs for a high-value application?

  1. By relying on a single control that is assumed to be perfect
  2. By delaying all control selection until after deployment
  3. By applying only controls that are cheapest to implement
  4. By combining complementary controls so that failure of one does not leave the application unprotected Correct answer.

Explanation

Defence in depth means layering complementary controls so that a single failure does not expose the application. Relying on one assumed-perfect control, minimising cost or postponing selection all weaken the resulting assurance.