I85PREP
⌘ K
ISO/IEC 27034 Lead Application Security Auditor study materials
ISO/IEC 27034 Lead Application Security Auditor study resources

ISO/IEC 27034 Lead Application Security Auditor practice questions

One question at a time. Build your ISO/IEC 27034 Lead Application Security Auditor understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1ISO/IEC 27034 fundamentals and application security concepts

In ISO/IEC 27034, what is the primary purpose of the Application Security Control (ASC)?

  1. To replace the organization's risk assessment methodology
  2. To schedule penetration tests for production applications
  3. To define a verifiable requirement that mitigates a specific application security risk Correct answer.
  4. To certify developers in secure coding languages

Explanation

An ASC is a measurable control statement that addresses identified application security risks and is verified during the process. It is not a scheduling artifact or a certification scheme; it is the atomic unit of control used throughout ISO/IEC 27034.

Question 2ISO/IEC 27034 fundamentals and application security concepts

Which ISO/IEC 27034 concept describes a statement of the security behaviour expected from an application in measurable terms?

  1. Security assurance level
  2. Application security control
  3. Application security requirement Correct answer.
  4. Trust level

Explanation

An application security requirement expresses what the application must achieve, and it is subsequently satisfied by one or more ASCs. Controls are the means, requirements are the ends. Assurance level and trust level are different concepts in the framework.

Question 3ISO/IEC 27034 fundamentals and application security concepts

ISO/IEC 27034 is structured as a multi-part standard. Which statement best describes the role of Part 1?

  1. It lists country-specific legal requirements for application data
  2. It provides overview and fundamental concepts that frame the whole series Correct answer.
  3. It provides the source code templates for secure development
  4. It contains the detailed audit procedure for certification bodies

Explanation

Part 1 of ISO/IEC 27034 gives the overview, concepts and general principles that underpin the remaining parts. The other parts elaborate methods, processes and frameworks rather than legal lists or code templates.

Question 4ISO/IEC 27034 fundamentals and application security concepts

Which element of the ISO/IEC 27034 framework establishes the organizational context in which application security is managed, including business, regulatory and technical factors?

  1. The Organization Normative Framework (ONF) Correct answer.
  2. The verification process
  3. The Application Security Control library
  4. The Application Normative Framework (ANF)

Explanation

The ONF captures organization-wide norms, roles, processes and control libraries that apply to all applications. Each application then derives its own ANF from the ONF, tailored to that application's context.

Question 5ISO/IEC 27034 fundamentals and application security concepts

What is the relationship between the Organization Normative Framework and the Application Normative Framework?

  1. The ANF replaces the ONF once an application is audited
  2. They are identical documents maintained in parallel
  3. The ONF is derived from the ANF after each application is deployed
  4. The ANF is derived from and tailored out of the ONF for a specific application Correct answer.

Explanation

The ONF represents reusable organizational norms, and the ANF selects and tailors relevant elements from it for one application's context. This derivation preserves consistency while allowing application-specific controls.

Question 6ISO/IEC 27034 fundamentals and application security concepts

During an application security audit, an auditor finds that a control's implementation is documented but no evidence of its verification exists. What is the most accurate conclusion under ISO/IEC 27034?

  1. The control is automatically effective because documentation exists
  2. The control must be removed from the ANF
  3. The control should be reclassified as a requirement
  4. The control cannot yet be considered effective because verification evidence is missing Correct answer.

Explanation

ISO/IEC 27034 treats verification as an integral part of establishing that a control achieves its intended outcome. Documentation of implementation alone does not demonstrate effectiveness. The auditor should seek or request verification evidence before concluding on control effectiveness.

Question 7ISO/IEC 27034 fundamentals and application security concepts

Which of the following best describes the role of the application security audit within the ISO/IEC 27034 lifecycle?

  1. It assigns developers to security roles
  2. It provides independent evaluation of whether the application's security controls and processes conform to the ANF Correct answer.
  3. It authorizes the application for public release
  4. It replaces the design review by testing production traffic

Explanation

An application security audit evaluates conformance and effectiveness against the defined normative framework and evidence. It informs decisions such as release, but it does not itself authorize release or replace design activities.

Question 8ISO/IEC 27034 fundamentals and application security concepts

Which statement correctly distinguishes an application security control from a security safeguard in general IT terms?

  1. An ASC applies only to network perimeter devices
  2. An ASC is a synonym for an antivirus signature
  3. An ASC is defined only after an incident occurs
  4. An ASC is scoped to application-level risk and is verifiable within the application's normative framework Correct answer.

Explanation

ASCs are application-focused, risk-driven and verifiable within the ANF. They are not generic infrastructure safeguards and are defined proactively as part of the security process.

Question 9ISO/IEC 27034 fundamentals and application security concepts

An organization wants to reuse a set of security controls across many applications while allowing tailoring per application. Which ISO/IEC 27034 structure supports this?

  1. Copying the entire ONF into every application's source repository
  2. Using only the verification process without a control library
  3. Maintaining a shared ASC library in the ONF and selecting tailored controls into each ANF Correct answer.
  4. Requiring each application to define controls from scratch

Explanation

The ONF provides a reusable library of ASCs and related norms; each application's ANF selects and tailors relevant controls. This balances consistency and application-specific context.

Question 10ISO/IEC 27034 fundamentals and application security concepts

Which activity is most closely associated with establishing the trustworthiness of an application before it is deployed into a high-risk environment?

  1. Purchasing additional network bandwidth
  2. Assessing the application against its ANF and verifying the applicable ASCs Correct answer.
  3. Increasing the number of developers on the project
  4. Adding more logging to the production environment

Explanation

Trustworthiness is established by evaluating the application against its normative framework and verifying the applicable controls. Operational changes such as logging or staffing do not by themselves establish assurance.

Question 11ISO/IEC 27034 fundamentals and application security concepts

What does the term 'application security control verification' most accurately mean in ISO/IEC 27034 terms?

  1. Counting the number of controls listed in a document
  2. Reviewing the application's marketing materials
  3. Confirming through defined evidence that an ASC achieves its intended security outcome Correct answer.
  4. Confirming that the application compiles without errors

Explanation

Verification establishes, using defined evidence and methods, that a control achieves its intended outcome. Counting controls or reviewing unrelated artifacts does not demonstrate effectiveness.

Question 12ISO/IEC 27034 fundamentals and application security concepts

Which concept in ISO/IEC 27034 reflects the level of confidence that an application meets its security requirements, based on the strength of evidence?

  1. Security assurance Correct answer.
  2. Development velocity
  3. Application functionality
  4. Code coverage

Explanation

Security assurance reflects justified confidence based on evidence that requirements are met. Functionality, velocity and code coverage are development metrics, not assurance concepts in the framework.

Question 13ISO/IEC 27034 fundamentals and application security concepts

An auditor reviews an application's ANF and finds controls that are not traceable to any identified risk or requirement. What is the most appropriate audit observation?

  1. The ANF should be discarded and rebuilt from the ONF
  2. The controls prove the application is over-secured and should be ignored
  3. The traceability gap should be raised because controls should be justified by requirements or risks Correct answer.
  4. The controls should be deleted immediately without further review

Explanation

ISO/IEC 27034 emphasizes traceability between risks, requirements and controls so that effort is justified and coverage is demonstrable. Untraceable controls indicate a documentation or process gap that should be investigated, not automatically deleted.

Question 14ISO/IEC 27034 fundamentals and application security concepts

Which statement best captures the ISO/IEC 27034 view of security throughout the application lifecycle?

  1. Security is addressed only during the testing phase
  2. Security is addressed only after a breach is detected
  3. Security is addressed only during procurement
  4. Security activities should be integrated from requirements through design, build, deployment and operation Correct answer.

Explanation

The framework treats application security as a lifecycle concern, with controls and verification applied at multiple stages. Confining security to testing or post-incident response leaves earlier risks unaddressed.

Question 15ISO/IEC 27034 fundamentals and application security concepts

Which of the following is the best example of an application security control that could be recorded in an ASC library?

  1. Input validation must reject untrusted data before it reaches database queries Correct answer.
  2. The application must be popular with users
  3. The development team must hold weekly meetings
  4. The application must support multiple languages

Explanation

An ASC is a specific, verifiable security measure mitigating an identified risk, such as input validation against injection. Popularity, meeting cadence and localization are not security controls.

Question 16ISO/IEC 27034 fundamentals and application security concepts

An organization applies a control from its ONF library to an application without adjusting for the application's specific architecture. What risk does ISO/IEC 27034 tailoring primarily address?

  1. Tailoring exists to eliminate the need for verification
  2. A control that is appropriate organizationally may be ineffective or irrelevant in a given application context Correct answer.
  3. Tailoring exists to reduce the number of controls to zero
  4. Tailoring exists to avoid documenting the ANF

Explanation

Tailoring adapts organizational norms to the application's context so that controls remain relevant and effective. It does not remove the need for documentation or verification.

Question 17ISO/IEC 27034 fundamentals and application security concepts

Which party typically holds accountability for approving an application's ANF within an ISO/IEC 27034-aligned governance model?

  1. The application's end users
  2. An external penetration tester
  3. The individual developer who wrote the most code
  4. The organization's designated application security authority with defined accountability Correct answer.

Explanation

Governance assigns accountability to a defined authority responsible for approving the ANF and related security decisions. Developers, testers and users contribute evidence or input but do not hold this accountability.

Question 18ISO/IEC 27034 fundamentals and application security concepts

Which statement accurately reflects the relationship between risk assessment and ASC selection in ISO/IEC 27034?

  1. Risk assessment is performed only after controls are implemented
  2. Controls are selected based solely on vendor marketing
  3. Controls are selected randomly to satisfy auditors
  4. Identified application risks drive the selection of appropriate controls to mitigate them Correct answer.

Explanation

Risk assessment identifies the threats and impacts that determine which controls are needed. Selecting controls without risk basis undermines justification and traceability.

Question 19ISO/IEC 27034 fundamentals and application security concepts

An auditor is evaluating whether an application's security requirements are complete. Which evidence would best support this conclusion?

  1. The application's user interface mockups
  2. Traceability from identified risks and business requirements to defined security requirements Correct answer.
  3. The number of automated tests executed
  4. A list of all developers who worked on the application

Explanation

Completeness of security requirements is demonstrated by traceability from risks and business needs to the requirements defined. Developer lists, mockups and test counts do not show that requirements cover the identified risks.

Question 20ISO/IEC 27034 fundamentals and application security concepts

Which term describes the process of determining whether an application's implemented controls satisfy the requirements defined in its ANF?

  1. Incident triage
  2. Release management
  3. Capacity planning
  4. Conformity assessment Correct answer.

Explanation

Conformity assessment evaluates whether implemented controls meet the requirements and norms defined for the application. Capacity planning, release management and incident triage are operational processes with different objectives.

Question 21ISO/IEC 27034 fundamentals and application security concepts

Why does ISO/IEC 27034 emphasize measurable or verifiable control statements rather than aspirational statements?

  1. Verifiable statements remove the need for documentation
  2. Verifiable statements allow objective determination of whether the control is effective Correct answer.
  3. Measurable statements eliminate the need for risk assessment
  4. Aspirational statements are always more secure

Explanation

Verifiability enables auditors and assessors to determine objectively whether a control achieves its intended outcome. It does not replace risk assessment or documentation; rather, it makes assurance possible.

Question 22ISO/IEC 27034 fundamentals and application security concepts

Which of the following best describes the difference between an application security requirement and a security control in ISO/IEC 27034?

  1. A requirement states what must be achieved, while a control describes how it is achieved and verified Correct answer.
  2. A requirement is optional, while a control is mandatory
  3. They are interchangeable terms with no distinction
  4. A control is a business goal, while a requirement is a technical measure

Explanation

Requirements express expected security outcomes, and controls are the measures that achieve and demonstrate those outcomes. The framework keeps them distinct to support traceability and verification.

Question 23ISO/IEC 27034 fundamentals and application security concepts

During an audit, an application owner claims that because the application uses a well-known secure framework, no further security controls are needed. How should the auditor respond under ISO/IEC 27034 principles?

  1. The claim is valid because frameworks guarantee security
  2. Framework use is a starting point, but application-specific risks still require defined and verified controls Correct answer.
  3. The claim is valid only if the framework is open source
  4. The claim is valid only if the application has no users

Explanation

Using a secure framework reduces some risk but does not address application-specific threats, configuration and logic. ISO/IEC 27034 requires controls to be defined and verified against the application's own risks and requirements.

Question 24ISO/IEC 27034 fundamentals and application security concepts

Which of the following is the most appropriate use of the ONF during the audit of a new application?

  1. Using it to determine the application's marketing strategy
  2. Using it to replace the need for evidence collection
  3. Using it as the organizational baseline against which the application's ANF and controls are compared Correct answer.
  4. Using it as a substitute for reviewing the application's own documentation

Explanation

The ONF provides the organizational baseline of norms and controls; auditors compare the application's ANF and evidence against it. It complements, but does not substitute for, application-specific documentation and evidence.

Question 25ISO/IEC 27034 fundamentals and application security concepts

Which of the following best characterizes the concept of 'application security control' in relation to identified risk?

  1. It is a performance optimization technique
  2. It is any feature that improves user experience
  3. It is a legal contract with a software vendor
  4. It is a measure designed to reduce or manage a specific identified risk to an acceptable level Correct answer.

Explanation

ASCs are risk-driven measures intended to reduce or manage identified risks to acceptable levels. User experience features, contracts and performance optimizations are not security controls in this sense.

Question 26ISO/IEC 27034 fundamentals and application security concepts

In ISO/IEC 27034, what is the primary purpose of the Application Security Control (ASC) library?

  1. To provide a catalog of commercial security products approved for procurement
  2. To store reusable, verifiable security control specifications that can be selected and tailored for applications Correct answer.
  3. To document the organizational security policy for all IT systems
  4. To record the results of penetration tests for each application

Explanation

The ASC library is a core ISO/IEC 27034 construct that holds reusable application security control specifications. These controls are defined in a measurable, verifiable way so they can be selected and tailored to the specific needs of an application during its lifecycle. It is not a policy repository, a test log, or a product catalog.

Question 27ISO/IEC 27034 fundamentals and application security concepts

Which statement best describes the role of the Organization Normative Framework (ONF) in ISO/IEC 27034?

  1. It specifies the cryptographic algorithms mandated for all applications
  2. It defines the organization's overall application security policies, processes, and reusable controls Correct answer.
  3. It is a certification scheme for application security auditors
  4. It contains the detailed design documentation for a single application

Explanation

The ONF is the organization-level framework that establishes application security policies, processes, and a library of reusable controls. It provides the normative basis from which application-specific frameworks are derived. It is not application design documentation, an auditor certification, or a cryptographic standard.

Question 28ISO/IEC 27034 fundamentals and application security concepts

What is the main difference between the Organization Normative Framework (ONF) and the Application Normative Framework (ANF)?

  1. The ONF applies only to developed applications, while the ANF applies only to acquired applications
  2. The ONF contains technical controls, while the ANF contains only management controls
  3. The ONF is maintained by the auditor, while the ANF is maintained by the developer
  4. The ONF is organization-wide and reusable, while the ANF is specific to one application and derived from the ONF Correct answer.

Explanation

The ONF provides the organization-level policies, processes, and control library that apply across all applications. The ANF is created for a specific application by selecting and tailoring elements from the ONF to meet that application's particular security requirements and context. This hierarchical relationship is fundamental to ISO/IEC 27034.

Question 29ISO/IEC 27034 fundamentals and application security concepts

An auditor is examining how an organization determines the level of trustworthiness of an application. Which ISO/IEC 27034 concept provides the basis for this determination?

  1. Application security risk assessment
  2. Application security control verification
  3. Application security management process
  4. Application security assurance Correct answer.

Explanation

Application security assurance is the ISO/IEC 27034 concept that reflects the level of confidence that an application meets its security requirements based on evidence. It is the outcome of verification and validation activities and provides the basis for trustworthiness determinations. Verification is one activity that contributes to assurance, but assurance is the overarching concept.

Question 30ISO/IEC 27034 fundamentals and application security concepts

Which of the following best describes the purpose of the application security control verification process in ISO/IEC 27034?

  1. To identify new security risks that were not considered during requirements analysis
  2. To document the application's business functionality
  3. To confirm that each selected control has been implemented and operates as specified Correct answer.
  4. To approve the application for production deployment

Explanation

Verification in ISO/IEC 27034 is the process of confirming that controls have been implemented and are functioning as intended. It provides evidence that the control specifications have been met and feeds into the overall assurance determination. It is not a risk identification exercise, a deployment approval gate, or business documentation.

Question 31ISO/IEC 27034 fundamentals and application security concepts

In ISO/IEC 27034, what is the relationship between an application security control and a security requirement?

  1. A control is a specification of a measure to meet one or more requirements, while a requirement states a needed security outcome Correct answer.
  2. A control is derived only after a requirement has been verified as met
  3. A control and a requirement are synonymous and can be used interchangeably
  4. A requirement is a technical implementation detail, while a control is a high-level business goal

Explanation

A security requirement expresses a needed security outcome or property that the application must satisfy. A control is a specified measure-often reusable and verifiable-that is selected to meet those requirements. Requirements drive the selection of controls, not the reverse.

Question 32ISO/IEC 27034 fundamentals and application security concepts

An organization is defining an application security control for its ASC library. Which characteristic is most important for the control statement to be useful in an ISO/IEC 27034 audit?

  1. It is written in general terms so it can apply to any technology
  2. It is kept confidential and not shared with auditors
  3. It is measurable and verifiable, allowing evidence of implementation to be assessed Correct answer.
  4. It is aligned with a specific vendor's security product

Explanation

ISO/IEC 27034 emphasizes that controls should be specified in a measurable and verifiable manner so that auditors can assess whether they have been implemented and are effective. Vague or aspirational statements cannot be objectively verified. Vendor-specific or confidential controls undermine reusability and auditability.

Question 33ISO/IEC 27034 fundamentals and application security concepts

During an audit, an auditor finds that an application's ANF includes controls that are not traced to any identified security requirement. What is the most appropriate audit conclusion?

  1. The controls are automatically valid because they come from the ONF
  2. The auditor should ignore the finding because additional controls never harm security
  3. The controls may be unnecessary and the ANF lacks traceability, indicating a weakness in the requirements-to-controls mapping Correct answer.
  4. The application should be immediately decommissioned

Explanation

ISO/IEC 27034 expects a clear traceability from security requirements to selected controls. Controls that cannot be traced to a requirement may be unnecessary, increase cost and complexity, and indicate a breakdown in the requirements analysis or tailoring process. The auditor should report this as a weakness in the ANF's traceability.

Question 34ISO/IEC 27034 fundamentals and application security concepts

Which statement best reflects how ISO/IEC 27034 treats security throughout the application lifecycle?

  1. Security is the sole responsibility of the operations team after handover
  2. Security activities should be integrated from requirements definition through design, development, testing, deployment, and maintenance Correct answer.
  3. Security is primarily a concern during the testing phase before deployment
  4. Security should be addressed only after the application is in production

Explanation

ISO/IEC 27034 promotes a lifecycle approach in which security is considered at every stage, from initial requirements through design, development, testing, deployment, and ongoing maintenance. This ensures that security requirements are continuously addressed and verified. Treating security as a single-phase activity leads to gaps and higher remediation costs.

Question 35ISO/IEC 27034 fundamentals and application security concepts

In the context of ISO/IEC 27034, what is the primary role of an application security audit?

  1. To develop the application's business requirements
  2. To design and implement security controls for the application
  3. To manage the application's user access requests
  4. To provide independent assurance that the application security processes and controls conform to the organization's normative framework and are effective Correct answer.

Explanation

An application security audit provides independent evaluation of whether the application's security processes and controls conform to the ONF/ANF and are operating effectively. It is an assurance activity, not a design, development, or operational function. The auditor assesses evidence and reports findings.

Question 36ISO/IEC 27034 fundamentals and application security concepts

Which of the following best describes the concept of 'application security control' in ISO/IEC 27034?

  1. A specification of a security measure designed to meet one or more security requirements for an application Correct answer.
  2. A password complexity rule enforced by the operating system
  3. A hardware device that enforces network perimeter security
  4. A legal contract clause requiring security compliance from a vendor

Explanation

In ISO/IEC 27034, an application security control is a specification of a measure that addresses one or more security requirements for an application. It is a reusable, verifiable statement that can be selected and tailored. It is not limited to hardware, legal clauses, or OS-level rules, though such elements may support control implementation.

Question 37ISO/IEC 27034 fundamentals and application security concepts

An auditor is reviewing the tailoring of controls from the ONF to an application's ANF. Which factor is most relevant in justifying why a particular control was tailored or omitted?

  1. The availability of budget for security tools
  2. The personal preference of the lead developer
  3. The application's specific risk profile and security requirements Correct answer.
  4. The number of users the application supports

Explanation

Tailoring of controls in ISO/IEC 27034 should be driven by the application's specific risk assessment and security requirements. The ANF is derived from the ONF by selecting and adjusting controls to fit the application's context, risk level, and requirements. Personal preference, budget, or user count alone are not adequate justifications.

Question 38ISO/IEC 27034 fundamentals and application security concepts

Which statement accurately describes the relationship between risk assessment and the selection of application security controls in ISO/IEC 27034?

  1. Risk assessment is performed only after controls have been implemented to check for residual risk
  2. Risk assessment is used solely to calculate the financial cost of a breach
  3. Risk assessment identifies and evaluates risks that inform which security requirements and controls are needed Correct answer.
  4. Risk assessment is optional and not referenced in ISO/IEC 27034

Explanation

In ISO/IEC 27034, risk assessment is a key input to determining security requirements and selecting appropriate controls. It helps identify threats and vulnerabilities and evaluate their potential impact, thereby guiding the choice of controls. It is an ongoing activity, not merely a post-implementation check.

Question 39ISO/IEC 27034 fundamentals and application security concepts

An organization wants to ensure that its application security controls remain effective over time. Which ISO/IEC 27034-aligned activity best supports this goal?

  1. Documenting controls once and never revising them
  2. Periodic review and updating of controls based on changes in risk, technology, and incidents Correct answer.
  3. One-time verification of controls at the end of development
  4. Relying solely on automated tools without human review

Explanation

ISO/IEC 27034 emphasizes continuous improvement and monitoring. Controls should be periodically reviewed and updated to remain effective as risks, technologies, and business context change. A one-time verification or static documentation cannot ensure ongoing effectiveness.

Question 40ISO/IEC 27034 fundamentals and application security concepts

During an audit, an auditor finds that an application's security controls were selected without documented consideration of the application's specific risk profile. Which ISO/IEC 27034 principle is most directly violated?

  1. Least privilege for database administrators
  2. Encryption of data at rest
  3. Separation of duties between development and operations
  4. Risk-based tailoring of controls to the application's context Correct answer.

Explanation

ISO/IEC 27034 requires that controls be selected and tailored based on the application's specific risk assessment and requirements. Selecting controls without considering the risk profile undermines the risk-based approach and may result in inappropriate or ineffective controls. The other options are specific security principles or controls, not the overarching tailoring principle.

Question 41Planning application security audits based on ISO/IEC 27034

In ISO/IEC 27034-1, which artifact provides the organization-wide catalogue of security controls that can be applied to application components?

  1. The Target Application Security Level (ASL)
  2. The Application Security Control (ASC) library entry
  3. The Organization Normative Framework (ONF) Correct answer.
  4. The Application Normative Framework (ANF)

Explanation

The ONF is the organization-level normative framework that holds reusable security controls, processes, and supporting material. Individual applications then derive their own ANF by selecting from the ONF. The ASC library is a component within that framework, not the framework itself.

Question 42Planning application security audits based on ISO/IEC 27034

When planning an application security audit, what is the primary purpose of establishing the audit scope against the application's ANF?

  1. To replace the ONF with the application-specific framework for the duration of the audit
  2. To document the auditor's independence from the application development organization
  3. To reduce the number of controls to those the development team finds easiest to implement
  4. To confirm that each selected control has an owner, evidence source, and verification method Correct answer.

Explanation

Scoping against the ANF means identifying which controls are in scope and how each will be verified, including who owns it and what evidence exists. This makes the audit plan executable and traceable. Scoping is not about choosing convenient controls or substituting frameworks.

Question 43Planning application security audits based on ISO/IEC 27034

An organization is defining the target Application Security Level (ASL) for a new customer-facing payment app. Which input is most relevant to that determination?

  1. The business impact and threat exposure of the application's data and functions Correct answer.
  2. The number of auditors available in the coming quarter
  3. The historical count of defects found in previous releases
  4. The programming language and framework used by the development team

Explanation

Target ASL reflects the assurance needed given business criticality, sensitivity of data, and exposure to threats. Technology stack, staffing, and defect history inform implementation and risk but do not by themselves set the required assurance level.

Question 44Planning application security audits based on ISO/IEC 27034

Which statement best describes the relationship between an ASC and an ANF in ISO/IEC 27034?

  1. An ASC replaces the ANF once the application enters production
  2. An ANF is a mandatory subset of every ASC in the organization
  3. An ASC is generated automatically whenever an ANF is approved
  4. An ANF selects and tailors ASCs from the ONF for a specific application Correct answer.

Explanation

The ANF is the application-specific framework assembled by selecting and tailoring applicable controls, which are drawn from the ONF's ASC library. The ASC is the reusable control unit; the ANF is the application-level assembly. Neither replaces the other over the lifecycle.

Question 45Planning application security audits based on ISO/IEC 27034

During audit planning, the lead auditor maps each in-scope control to a verification procedure. What characteristic must those procedures have to support a defensible conclusion?

  1. They must be approved by the development manager before execution
  2. They must be repeatable and produce evidence that another auditor could re-perform Correct answer.
  3. They must be performed exclusively through automated scanning tools
  4. They must be completed within a single working day per control

Explanation

Verification procedures need to be repeatable and evidence-based so that conclusions can be re-performed and defended. Automation is useful but not mandatory, and speed or developer approval are not validity criteria. Independence would actually be undermined by requiring the auditee to approve procedures.

Question 46Planning application security audits based on ISO/IEC 27034

What is the main reason an audit plan for application security should reference the organization's risk assessment results?

  1. To guarantee that no security incidents will occur during the audit period
  2. To satisfy the requirement that auditors perform penetration testing themselves
  3. To eliminate the need for an ANF for low-risk applications
  4. To prioritize controls and sampling effort where impact and likelihood are highest Correct answer.

Explanation

Risk results direct where audit effort and sampling should concentrate, making the plan proportionate. An audit plan cannot guarantee absence of incidents, and it does not remove the need for an ANF. Penetration testing may be one technique but is not mandated for auditors by planning.

Question 47Planning application security audits based on ISO/IEC 27034

Which element belongs in an application security audit plan rather than in the application's ANF itself?

  1. The list of selected security controls applicable to the application
  2. The schedule of audit activities and the sampling approach for evidence collection Correct answer.
  3. The tailoring rationale for controls adopted from the ONF
  4. The mapping of controls to application components

Explanation

The audit plan describes how the audit will be executed, including timing, sampling, and resource allocation. Control selection, tailoring rationale, and component mapping are content of the ANF. Keeping these distinct prevents the plan from being confused with the framework under audit.

Question 48Planning application security audits based on ISO/IEC 27034

An auditor is planning to assess whether security requirements were addressed during the specify phase of an application's lifecycle. Which evidence source is most direct?

  1. Approved security requirements traced to design and test cases Correct answer.
  2. The team's agile velocity chart for recent sprints
  3. The production incident register for the last twelve months
  4. The vendor's marketing brochure for the application platform

Explanation

Traceability from approved security requirements through design and testing directly evidences that requirements were specified and carried forward. Incident registers, velocity charts, and vendor brochures do not show requirement specification.

Question 49Planning application security audits based on ISO/IEC 27034

What does the concept of 'security assurance level' contribute to audit planning in ISO/IEC 27034?

  1. It specifies the programming standards the developers must follow
  2. It fixes the number of auditors assigned to every application
  3. It determines the licensing cost of the application platform
  4. It sets the rigour and depth of verification expected for the application's controls Correct answer.

Explanation

The assurance level expresses how much confidence is required, which translates into verification depth and rigour in the audit plan. It does not prescribe coding standards, licensing, or fixed staffing numbers. Those are separate decisions.

Question 50Planning application security audits based on ISO/IEC 27034

A lead auditor finds that the application's ANF omits a control that the ONF marks as mandatory for the application's target ASL. What is the most appropriate planning response?

  1. Silently add the control to the ANF so the audit can proceed
  2. Reduce the target ASL so the control is no longer required
  3. Record the gap as an audit finding and assess the justification for any tailoring Correct answer.
  4. Exclude the control from scope because it is absent from the ANF

Explanation

A missing mandatory control is a legitimate finding, and any claimed tailoring must be evaluated for justification and approval. The auditor must not modify the auditee's framework, lower the assurance requirement, or drop the control from scope. Independence and objectivity require documenting the gap.