I85PREP
⌘ K
ISO/IEC 27034 Lead Application Security Implementer study materials
ISO/IEC 27034 Lead Application Security Implementer study resources

ISO/IEC 27034 Lead Application Security Implementer practice questions

One question at a time. Build your ISO/IEC 27034 Lead Application Security Implementer understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental principles and concepts of application security

In ISO/IEC 27034-1, what does an Application Security Control (ASC) primarily describe?

  1. A verified implementation of a security control for a specific application, with defined evidence Correct answer.
  2. A generic catalog entry describing a security objective without any application context
  3. A penetration test report issued by an accredited third-party laboratory
  4. A contractual clause transferring security liability to the software supplier

Explanation

ISO/IEC 27034-1 defines an Application Security Control as a control that has been selected and implemented for a particular application, together with the evidence showing it achieves its stated security objective. It is therefore application-specific and evidence-backed, not a generic catalog entry or an assessment artifact.

Question 2Fundamental principles and concepts of application security

Which statement best captures the purpose of the Application Security Management Process (ASMP) in ISO/IEC 27034?

  1. It provides a repeatable process for selecting, implementing, and verifying security controls across an application's lifecycle Correct answer.
  2. It prescribes a single mandatory software development lifecycle model for all organizations
  3. It defines the cryptographic algorithms that applications must use for data protection
  4. It replaces the organization's overall information security management system for software teams

Explanation

The ASMP is the governance process that lets an organization consistently determine required security controls, implement them, and verify their effectiveness throughout the application lifecycle. It operates within, and does not replace, the broader ISMS, and it remains technology- and lifecycle-model-neutral.

Question 3Fundamental principles and concepts of application security

An organization wants to reuse security requirements across many projects. In ISO/IEC 27034 terms, which artifact holds reusable, organization-level security control specifications?

  1. The Organization Normative Framework (ONF) Correct answer.
  2. The Application Normative Framework (ANF)
  3. The audit log of the application
  4. The Application Security Plan (ASP)

Explanation

The Organization Normative Framework captures the organization's reusable security policies, control catalogs, and processes that apply to all applications. Each individual application then derives its own Application Normative Framework from the ONF.

Question 4Fundamental principles and concepts of application security

What is the relationship between the Organization Normative Framework (ONF) and an Application Normative Framework (ANF)?

  1. They are identical documents maintained by different teams
  2. The ANF is a subset tailored from the ONF for one specific application Correct answer.
  3. The ANF supersedes the ONF for all applications in the organization
  4. The ONF is derived from the ANF after the application is deployed

Explanation

The ONF is the organization-wide baseline, and each application selects and tailors the relevant parts of it to produce its own ANF. The ANF therefore records the controls actually applicable to that application, including justified exclusions.

Question 5Fundamental principles and concepts of application security

Which concept in ISO/IEC 27034 describes the level of confidence that an application meets its security requirements, expressed through collected evidence?

  1. Application license compliance
  2. Application performance baseline
  3. Application security assurance Correct answer.
  4. Application portability

Explanation

Application security assurance reflects justified confidence, built from evidence such as test results, reviews, and monitoring data, that the application satisfies its security requirements. It is a measure of demonstrated trustworthiness rather than of functional or commercial attributes.

Question 6Fundamental principles and concepts of application security

During a risk assessment, a team identifies that a public-facing application handles payment card data. Which factor most directly determines the rigor of the security controls selected for that application?

  1. The programming language chosen by the development team
  2. The release cadence of the marketing department
  3. The number of developers assigned to the project
  4. The business and security risk associated with the application and its data Correct answer.

Explanation

ISO/IEC 27034 ties control selection to the risk that the application presents to the organization, considering data sensitivity, exposure, and business impact. Language, team size, and unrelated schedules do not by themselves determine required control rigor.

Question 7Fundamental principles and concepts of application security

Which activity belongs to the verification step of the Application Security Management Process?

  1. Drafting the organization's security policy for approval by executive management
  2. Confirming through testing and review that implemented controls achieve their stated objective Correct answer.
  3. Selecting a vendor to supply the application's database engine
  4. Estimating the development budget for the next fiscal year

Explanation

Verification in the ASMP means gathering evidence that the implemented controls actually satisfy their security objectives, typically through testing, review, and measurement. Policy drafting, procurement, and budgeting belong to other processes.

Question 8Fundamental principles and concepts of application security

What distinguishes an application security control from a general information security control in the ISO/IEC 27034 context?

  1. It is scoped and evidenced specifically for the application's software and data flows Correct answer.
  2. It only applies to physical access to data centers
  3. It must be certified by an external auditor before use
  4. It is documented exclusively in the organization's HR handbook

Explanation

Application security controls are defined in the context of a specific application, addressing its software behavior, data flows, and environment, and they carry evidence of implementation. General controls may be broader and are not necessarily tied to a single application.

Question 9Fundamental principles and concepts of application security

A team claims its application is secure because it passed a single penetration test before go-live. Which critique is most consistent with ISO/IEC 27034 principles?

  1. A penetration test is invalid unless performed by the development team itself
  2. A single test is sufficient if it covers the login page
  3. Assurance should be maintained continuously through lifecycle evidence, not a one-time test Correct answer.
  4. Assurance requires that no vulnerabilities ever be found in any test

Explanation

ISO/IEC 27034 treats application security as a lifecycle concern in which controls are selected, implemented, and verified with ongoing evidence. A single pre-release test provides only a point-in-time snapshot and cannot sustain assurance as the application and threats change.

Question 10Fundamental principles and concepts of application security

Which item is a typical component of an Application Normative Framework (ANF)?

  1. The organization's complete list of all employees and their roles
  2. The selected security controls applicable to that application and the justification for any tailoring Correct answer.
  3. The marketing plan for the application's launch
  4. The source code of unrelated applications in the portfolio

Explanation

An ANF records the controls chosen for one application from the ONF, together with tailoring decisions and their rationale. It is a security-scoped document, so personnel lists, unrelated code, and marketing plans do not belong in it.

Question 11Fundamental principles and concepts of application security

What role does traceability play in the application security management process?

  1. It links each security requirement to the controls and evidence that satisfy it Correct answer.
  2. It documents the salary bands of the security team
  3. It tracks the number of defects reported by end users
  4. It records the version history of the application's user interface

Explanation

Traceability connects requirements to the controls implemented for them and to the evidence proving those controls work. This lets auditors and engineers confirm coverage and detect gaps when requirements or designs change.

Question 12Fundamental principles and concepts of application security

Which statement about the scope of ISO/IEC 27034-1 is accurate?

  1. It replaces ISO/IEC 27001 for all organizations
  2. It certifies individual software products against a fixed checklist
  3. It provides overview concepts and principles for application security across the lifecycle Correct answer.
  4. It specifies detailed code-level rules for a single programming language

Explanation

ISO/IEC 27034-1 is an overview part that introduces concepts, principles, and the framework structure for application security. It does not prescribe language-specific coding rules, certify products, or replace the ISMS standard.

Question 13Fundamental principles and concepts of application security

An application's data classification changes from internal to confidential after a business merger. What is the most appropriate ISO/IEC 27034-aligned response?

  1. Take no action because the software code has not changed
  2. Reassess risks and update the application's normative framework and controls accordingly Correct answer.
  3. Delete the application's existing security evidence to start fresh
  4. Downgrade the classification to avoid additional controls

Explanation

Because control selection is risk-driven, a change in data sensitivity should trigger a reassessment and an update to the ANF and implemented controls. Unchanged code does not mean unchanged risk, and discarding evidence or downgrading classification would undermine assurance.

Question 14Fundamental principles and concepts of application security

In the ISO/IEC 27034 framework, what is the primary function of the organization's security policy layer?

  1. It sets the high-level direction from which application-level controls are derived Correct answer.
  2. It stores the runtime logs generated by production applications
  3. It defines the detailed unit tests for each software module
  4. It lists the individual performance ratings of developers

Explanation

The policy layer establishes management direction and objectives that flow down into the normative frameworks and, ultimately, into application-specific controls. Logs, unit tests, and personnel ratings are operational artifacts at other layers.

Question 15Fundamental principles and concepts of application security

Which pair correctly matches an ISO/IEC 27034 concept with its description?

  1. Assurance: the total count of source lines in an application
  2. Assurance: justified confidence supported by evidence that controls meet objectives Correct answer.
  3. Security control: a marketing claim published on a product page
  4. Normative framework: a temporary file used during compilation

Explanation

Assurance is justified confidence, grounded in evidence, that the application meets its security objectives. The other pairings misdescribe the concepts and mix them with unrelated artifacts.

Question 16Fundamental principles and concepts of application security

A development team argues that because it follows a secure coding standard, it does not need to verify controls. Which response best reflects ISO/IEC 27034?

  1. Following any coding standard removes the need for any security evidence
  2. Coding standards are irrelevant and should be abandoned
  3. Adopting a standard is a means to an end; verification provides the evidence that controls actually work Correct answer.
  4. Verification is only needed for applications written in interpreted languages

Explanation

ISO/IEC 27034 separates the implementation of controls from the verification that they achieve their objectives. A secure coding standard supports implementation, but evidence from testing and review is still required to establish assurance.

Question 17Fundamental principles and concepts of application security

What does the term 'application security control catalog' most likely refer to in an ISO/IEC 27034 implementation?

  1. A list of approved vendors for purchasing hardware
  2. A structured inventory of reusable controls from which application-specific controls are selected Correct answer.
  3. A register of customer complaints about the application
  4. A schedule of employee security awareness sessions

Explanation

A control catalog is a structured, reusable inventory of security controls, typically maintained at organization level, from which teams select and tailor controls for each application. It is not a procurement, complaint, or training record.

Question 18Fundamental principles and concepts of application security

Which scenario best illustrates the application of the principle that security should be addressed from the earliest lifecycle stages?

  1. Security requirements are elicited during design, before architecture is finalized Correct answer.
  2. Security requirements are written after the final release
  3. Security review is scheduled only when an incident occurs
  4. Security testing is performed only after the application is retired

Explanation

Addressing security early means defining requirements and considering threats during design, when changes are cheaper and more effective. Deferring security to incidents, retirement, or post-release stages contradicts this principle.

Question 19Fundamental principles and concepts of application security

In ISO/IEC 27034, what is the main purpose of recording the rationale for tailoring a control?

  1. It proves that the control was never needed in the first place
  2. It demonstrates that deviations were deliberate and risk-justified Correct answer.
  3. It allows the control to be reused unchanged in every other application
  4. It replaces the need for any verification evidence

Explanation

Documenting tailoring rationale shows that a control was adjusted or omitted for a considered, risk-based reason, preserving auditability. It does not eliminate the need for evidence, nor does it make the control universally reusable.

Question 20Fundamental principles and concepts of application security

Which statement best describes how ISO/IEC 27034 relates to other management system standards such as ISO/IEC 27001?

  1. It replaces all technical standards in the ISO/IEC 27000 family
  2. It provides application-level detail that supports and complements an existing ISMS Correct answer.
  3. It is designed to be used only by organizations without any ISMS
  4. It contradicts ISO/IEC 27001 and cannot be used together

Explanation

ISO/IEC 27034 supplies application-focused guidance that fits within and enriches an organization's ISMS rather than competing with it. Organizations with an existing ISMS can use it to add application-specific rigor.

Question 21Fundamental principles and concepts of application security

A team selects a control from the organization's catalog but implements it differently from the reference description. What should the ANF record?

  1. The tailored implementation and the risk-based justification for the deviation Correct answer.
  2. Nothing, because the catalog entry is the only record needed
  3. A note that the control was verified without any evidence
  4. A request to remove the control from the organization catalog

Explanation

When a control is tailored, the ANF should capture how it was implemented for the application and why the deviation is acceptable given the risk. This preserves traceability and supports later verification.

Question 22Fundamental principles and concepts of application security

Which of the following is the clearest example of evidence that supports application security assurance?

  1. The application's user interface color scheme
  2. A verbal assurance from a developer during a stand-up meeting
  3. The number of downloads of the application
  4. Documented results of security testing mapped to specific requirements Correct answer.

Explanation

Assurance evidence must be documented and traceable to the requirements it addresses, such as test results mapped to controls. Informal statements, visual design, and popularity metrics provide no verifiable security information.

Question 23Fundamental principles and concepts of application security

How does ISO/IEC 27034 treat the concept of trust between an application and its environment?

  1. Trust relationships and assumptions about the environment should be identified and managed as part of the application's security context Correct answer.
  2. Trust is irrelevant once the application is deployed
  3. Trust is assumed by default and requires no documentation
  4. Trust only matters for hardware, never for software

Explanation

Applications depend on assumptions about their environment, such as identity providers, networks, and platforms, and these trust relationships should be identified and managed. Leaving them implicit creates unexamined risk that persists after deployment.

Question 24Fundamental principles and concepts of application security

Which activity most directly supports the principle of least privilege within an application security program?

  1. Disabling access logging to reduce storage costs
  2. Granting each application component only the access rights it needs to perform its function Correct answer.
  3. Sharing a single privileged account across all environments
  4. Granting all components administrative rights to simplify troubleshooting

Explanation

Least privilege means each component receives only the minimum rights required for its function, limiting the impact of compromise. Broad administrative rights, shared accounts, and disabled logging all increase exposure.

Question 25Fundamental principles and concepts of application security

An auditor asks why a particular control was not applied to a low-risk internal tool. Which answer is most defensible under a risk-based application security framework?

  1. The development team preferred not to implement it
  2. The tool's risk assessment showed the control's objective was met by a compensating measure, documented in its normative framework Correct answer.
  3. The control was omitted because the tool uses a modern framework
  4. The tool was built quickly and deadlines took priority

Explanation

A defensible omission rests on a documented risk assessment and a compensating measure that still satisfies the control objective. Team preference, schedule pressure, and technology choice are not valid risk-based justifications.

Question 26Fundamental principles and concepts of application security

In ISO/IEC 27034-1, the application security risk assessment begins by relating the application to which two dimensions?

  1. Its programming language and its deployment platform
  2. Its license cost and its vendor support tier
  3. Its number of developers and their certification levels
  4. Its business criticality and its exposure to threat sources Correct answer.

Explanation

ISO/IEC 27034-1 frames application security risk around the business value or criticality of the application and the likelihood and impact of threats acting on it. Technical attributes such as language or platform matter only insofar as they influence those risk dimensions.

Question 27Fundamental principles and concepts of application security

Which principle explains why ISO/IEC 27034 treats application security as a lifecycle concern rather than a testing phase?

  1. Vulnerabilities introduced during design are cheaper and more reliably removed before code exists Correct answer.
  2. Developers are legally prohibited from fixing defects after release
  3. Testing phases are too short to find any defects in modern applications
  4. Security tools only operate correctly during the requirements phase

Explanation

The economic and technical argument is that defects, including security weaknesses, are far cheaper and more certain to remove when addressed at requirements and design. ISO/IEC 27034 therefore distributes security activities across the whole lifecycle instead of concentrating them in test.

Question 28Fundamental principles and concepts of application security

An organization wants assurance that a purchased application meets its security needs. Under ISO/IEC 27034 concepts, which characteristic of the supplier relationship is most relevant?

  1. The supplier's marketing spend on security certifications
  2. The number of years the supplier has existed
  3. The size of the supplier's office in the buyer's country
  4. The level of trust the organization can place in the supplier's application security evidence Correct answer.

Explanation

ISO/IEC 27034 treats trust as something that must be supported by evidence about the application and the supplier's processes. The relevant question is how much verifiable assurance the organization has, not proxies such as age or marketing.

Question 29Fundamental principles and concepts of application security

A team is defining the level of trust it requires for an application that processes payroll data. Which input most directly shapes that required trust level?

  1. The number of user stories completed in the last sprint
  2. The frequency of team stand-up meetings
  3. The IDE used by the development team
  4. The business impact if the application's data were disclosed or altered Correct answer.

Explanation

Required trust level is derived from the potential business impact of security failure, including confidentiality and integrity of the data handled. Process metrics such as sprint throughput do not determine how much assurance is needed.

Question 30Fundamental principles and concepts of application security

Which statement best captures how ISO/IEC 27034-1 positions application security within an organization's overall information security management?

  1. It is a specialization that inherits organizational policy and adds application-specific controls and evidence Correct answer.
  2. It is a standalone discipline that replaces the need for an organizational ISMS
  3. It applies only to applications developed in-house and excludes acquired software
  4. It is limited to cryptographic algorithm selection for data at rest

Explanation

ISO/IEC 27034 builds on the organization's governance layer, taking policy and risk appetite as inputs and adding application-level controls, roles, and evidence. It extends rather than replaces an ISMS, and it covers acquired as well as developed applications.

Question 31Fundamental principles and concepts of application security

A project records, for each selected application security control, the reason it was chosen and any deviation from the reference implementation. Which framework principle does this practice most directly serve?

  1. Accountability and defensibility of security decisions Correct answer.
  2. Compliance with coding style conventions
  3. Performance optimization of the application
  4. Reduction of licensing costs for security tooling

Explanation

Recording rationale and deviations creates an auditable trail that makes decisions defensible and assigns accountability. This supports assurance, since reviewers can later judge whether tailoring was justified.

Question 32Fundamental principles and concepts of application security

An application relies on an external identity provider for authentication. In ISO/IEC 27034 terms, how should this dependency be treated?

  1. As outside the scope of application security because it is a separate service
  2. As automatically trusted because it is a commercial cloud provider
  3. As irrelevant provided the application itself uses strong ciphers
  4. As part of the application's environment that must be assessed when establishing trust Correct answer.

Explanation

ISO/IEC 27034 recognizes that an application's trustworthiness depends on the environment it operates in, including dependent services. Dependencies such as an identity provider therefore need assessment as part of establishing the application's overall trust level.

Question 33Fundamental principles and concepts of application security

A risk analysis finds that a new feature raises the application's required trust level. Which response is most consistent with ISO/IEC 27034 principles?

  1. Defer all changes until the next annual audit cycle
  2. Lower the data classification so the trust level requirement falls
  3. Re-evaluate the selected controls and add or strengthen evidence to match the higher trust level Correct answer.
  4. Keep the existing controls because they were already approved once

Explanation

Because required trust level follows from risk, a change in risk should trigger re-evaluation of controls and the evidence supporting them. Controls approved under an earlier, lower trust level may no longer be sufficient.

Question 34Fundamental principles and concepts of application security

Two teams disagree about whether a compensating control provides equivalent protection to the reference control. Which approach best reflects ISO/IEC 27034's treatment of tailoring?

  1. Let the development team decide alone, since they understand the code best
  2. Reject all tailoring because reference controls must always be applied verbatim
  3. Adopt the compensating control silently to avoid documentation overhead
  4. Document the justification and the residual risk, then have it reviewed by the accountable role Correct answer.

Explanation

Tailoring is permitted but must be justified, its residual risk understood, and the decision reviewed by someone accountable for application security. Silent substitution or unilateral developer choice breaks the assurance chain, while blanket rejection ignores legitimate context.

Question 35Application security planning

In ISO/IEC 27034, what is the primary purpose of the Application Security Control (ASC) library maintained by an organization?

  1. To list the third-party software licenses used within each application
  2. To document the network firewall rules protecting application servers
  3. To record the personal data processing activities carried out by each application owner
  4. To store reusable, verifiable security controls that can be selected and applied to applications based on assessed risk Correct answer.

Explanation

The ASC library is a reusable catalogue of security controls, each with verification criteria, that an organization selects and tailors to a specific application according to its risk profile. It is the building block from which application security requirements are derived in ISO/IEC 27034.

Question 36Application security planning

Which statement best describes the role of the Organization Normative Framework (ONF) in ISO/IEC 27034?

  1. It is a legal contract defining liability between the developer and the customer
  2. It is the organization-wide reference set of security standards, controls, and processes reused across all applications Correct answer.
  3. It is a vendor-supplied runtime library that enforces input validation in production
  4. It is a temporary checklist produced only during the audit of a single application

Explanation

The ONF is the organization-level normative framework that consolidates standards, ASCs, processes, and roles reused by every application project. It provides the common reference from which application-specific frameworks are derived.

Question 37Application security planning

An organization is beginning application security planning and wants to establish the level of assurance an application requires. Which input is most relevant to this decision?

  1. The programming language chosen for implementation
  2. The physical location of the development office
  3. The number of developers assigned to the project team
  4. The assessed business impact and risk exposure of the application Correct answer.

Explanation

The required assurance level should be driven by the business criticality and risk exposure of the application, since controls and verification depth are scaled to risk. Team size, language, and office location do not determine the security assurance target.

Question 38Application security planning

In the ISO/IEC 27034 application security life cycle, at which point should security requirements and controls first be identified?

  1. Only after the application has been deployed to production
  2. During the requirements and planning phase, before design and construction begin Correct answer.
  3. Only when a penetration test finds a vulnerability
  4. After the application is retired and archived

Explanation

ISO/IEC 27034 promotes building security in from the start, so controls and requirements are selected during planning and requirements definition. Addressing them later increases cost and leaves design flaws embedded in the application.

Question 39Application security planning

What distinguishes an Application Security Control (ASC) from a generic security policy statement?

  1. An ASC must be approved by an external certification body before use
  2. An ASC includes defined verification criteria that allow its implementation to be objectively confirmed Correct answer.
  3. An ASC applies exclusively to network infrastructure devices
  4. An ASC is only written for auditors and never used by developers

Explanation

Each ASC pairs a control objective with verification criteria so that implementation can be assessed objectively. A generic policy statement expresses intent but lacks the measurable verification element that characterizes an ASC.

Question 40Application security planning

An application owner must decide how much verification evidence to collect for a low-risk internal tool. What is the most appropriate ISO/IEC 27034-aligned approach?

  1. Delegate verification entirely to the tool's end users
  2. Apply the same verification depth as for a payment system to keep processes uniform
  3. Skip all verification because the tool is internal
  4. Scale verification to the assessed risk, applying lighter evidence for the low-risk tool Correct answer.

Explanation

ISO/IEC 27034 is risk-driven: the rigor of control selection and verification should match the assessed risk and assurance level. Uniform maximum rigor wastes effort, while skipping verification for internal tools ignores residual risk.

Question 41Application security planning

During planning, a team maps each selected ASC to a verification method. Which pairing best reflects the intent of an ASC's verification criteria?

  1. Control: encrypt data at rest; verification: review configuration and test that storage volumes are encrypted Correct answer.
  2. Control: encrypt data at rest; verification: count the number of database tables
  3. Control: encrypt data at rest; verification: check the project's budget approval
  4. Control: encrypt data at rest; verification: confirm the developer attended a security awareness course

Explanation

Verification criteria must directly demonstrate that the control is implemented and effective. Reviewing configuration and testing encryption of storage volumes provides direct evidence, unlike unrelated training, counting, or budget records.

Question 42Application security planning

Which element is a core component of the Organization Normative Framework (ONF) that supports consistent application security planning?

  1. The source code repository's commit history
  2. The marketing plan for the application's launch
  3. A catalogue of approved ASCs and the processes for selecting and applying them Correct answer.
  4. A list of employee home addresses for emergency contact

Explanation

The ONF consolidates reusable ASCs plus the processes, roles, and standards for applying them across projects. This gives every application team a consistent, governed starting point for planning.

Question 43Application security planning

A project team wants to reuse organizational ASCs but needs to adapt them to a cloud-hosted microservice. What does ISO/IEC 27034 suggest?

  1. Apply the ASCs unchanged even if they reference on-premises infrastructure
  2. Ignore the ASCs and rely on the cloud provider's marketing claims
  3. Reject the organizational ASCs and write entirely new controls from scratch
  4. Tailor the selected organizational ASCs to the application's context and document the rationale Correct answer.

Explanation

The standard supports selecting from the ONF and tailoring controls to the specific application context, with the tailoring rationale recorded. Blind reuse or wholesale replacement both undermine the framework's intent of consistent, context-appropriate controls.

Question 44Application security planning

Why does ISO/IEC 27034 emphasize defining security roles and responsibilities during application security planning?

  1. To satisfy the requirement that all security work be done by external consultants
  2. To ensure each security activity has an accountable owner throughout the life cycle Correct answer.
  3. To reduce the number of developers needed on the project
  4. To eliminate the need for any verification activities

Explanation

Clear role assignment ensures that control selection, implementation, and verification are owned and not left unaddressed. Accountability across the life cycle is a planning prerequisite, not a staffing reduction or outsourcing mandate.

Question 45Application security planning

A team is planning an application and must decide which ASCs apply. Which approach best aligns with ISO/IEC 27034?

  1. Select ASCs alphabetically to ensure a consistent set
  2. Select ASCs by copying another organization's published list without review
  3. Select ASCs based on the assessed risk profile and business context of the application Correct answer.
  4. Select only the ASCs that are cheapest to implement

Explanation

ASC selection is risk-based and tied to the application's business context and assurance needs. Alphabetical, cost-only, or blindly copied selections ignore the risk-driven rationale the standard requires.

Question 46Application security planning

What is the relationship between the Organization Normative Framework (ONF) and an Application Specific Framework?

  1. The application-specific framework replaces the ONF for all future projects
  2. The application-specific framework is derived from and refines the ONF for a particular application Correct answer.
  3. They are identical documents with different titles
  4. The ONF is derived from each application-specific framework after deployment

Explanation

The application-specific framework is built by selecting and tailoring ONF elements to the needs of one application. The ONF remains the organization-wide reference that other applications also draw from.

Question 47Application security planning

An organization wants assurance that a chosen ASC is actually effective, not merely documented. Which planning decision best supports this?

  1. Record the ASC in a spreadsheet and consider the matter closed
  2. Rely on the developer's verbal assurance that the control works
  3. Define verification activities and acceptance criteria for each ASC in advance Correct answer.
  4. Defer all verification until after the application is retired

Explanation

Effectiveness requires planned verification against predefined acceptance criteria, giving objective evidence. Documentation alone or verbal assurance does not demonstrate that a control functions as intended.

Question 48Application security planning

Which planning artifact would most directly help a team trace an application's security requirements back to organizational controls?

  1. A schedule of team-building events
  2. A mapping that links each application requirement to the originating ASC Correct answer.
  3. A floor plan of the data center
  4. A list of customer support ticket categories

Explanation

Traceability from application requirements to source ASCs demonstrates coverage and supports verification and audit. The other artifacts have no bearing on security requirement traceability.

Question 49Application security planning

A risk assessment shows an application will handle regulated personal data. How should this influence application security planning under ISO/IEC 27034?

  1. It should eliminate the need for verification of access controls
  2. It should have no effect because the standard ignores data sensitivity
  3. It should raise the assurance level and drive selection of stronger, additional ASCs Correct answer.
  4. It should lower the assurance level to reduce project cost

Explanation

Higher sensitivity and regulatory exposure increase the required assurance, prompting stronger and additional controls. The framework is explicitly risk-driven, so data sensitivity directly shapes control selection and verification depth.

Question 50Application security planning

What is the main benefit of maintaining an organizational ASC library rather than defining controls anew for each project?

  1. Consistent, reusable controls with established verification criteria reduce effort and improve coverage Correct answer.
  2. It removes the need for any risk assessment
  3. It guarantees that no application will ever have a vulnerability
  4. It allows developers to skip all security testing

Explanation

A shared library promotes consistency and reuse, so teams start from proven controls and verification criteria instead of reinventing them. It does not guarantee vulnerability-free software or eliminate risk assessment and testing.