ISA 4.0 Module 7 – Topic Wise

Module 7: Application Security Audit Secure SDLC, DevSecOps, OWASP Top 10 Deep Dive, Threat Modelling, SAST, DAST & API Security Course Overview & Scope: Software is the engine of modern business, and flawed code creates catastrophic financial and reputational liabilities. This course provides 325 questions covering application security from design through production. Auditors learn to audit the Secure Software Development Life Cycle (SSDLC), embed security gates, evaluate threat models (STRIDE, DREAD), inspect architecture against Defence in Depth, analyze the OWASP Top 10 vulnerabilities (Broken Access Control, Cryptographic Failures, Injection, Insecure Design, Security Misconfigurations), and audit automated DevSecOps pipelines including Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA) for third-party libraries. Key Regulatory Frameworks & Standards Covered: OWASP Top 10:2021, OWASP ASVS (Application Security Verification Standard), NIST SP 800-64, ISO/IEC 27034 (Application Security). Core Audit Competencies Tested in Quizzes:

• Auditing Secure SDLC governance, security requirements capture, and peer code review procedures.
• Evaluating architectural threat models and security controls mapping using STRIDE/DREAD.
• Recognizing and auditing countermeasures against the OWASP Top 10 (SQL Injection, XSS, SSRF, Broken Authentication).
• Reviewing DevSecOps pipelines and SAST/DAST automated security scanning reports and false positive rates.
• Auditing RESTful API security, authentication tokens (JWT), rate limiting, and software supply chain dependencies.

Detailed Topic-Wise Active Quiz Index (Module 7)

Chapter / Section	Topic Quiz Title	Qs
Chapter 1: Understanding Application Security	Web Based Application Development	1
	SDLC Need, Benefits and Phases	1
	Concepts of IS Audit – Learning Objectives	1
Chapter 2: Secure SDLC Audit & Threat Modeling	Secure SDLC	1
	Requirement Definition	7
	Software Escrow	8
	Web Based Application Development	1
Chapter 3: Defence in Depth in Application Architecture	SDLC Need, Benefits and Phases	1
	Network Security Control Mechanisms	52
	Web Based Application Development	1
Chapter 4: Dive into the OWASP Top 10	OWASP Model	4
	Network Threats and Attacks – Scripts	7
	Network Threats and Attacks – Session Hijacking	3
	Network Threats and Attacks – Web Defacement	3
	Web Based Application Development	1
Chapter 5: Web Application Architecture	Web Based Application Development	1
	Corporate Governance and Regulatory Requirements	5
	Network Architecture	10
Chapter 6: Threat Modelling for Web Applications	Web Based Application Development	1
	Concept of IT Risk	7
Chapter 7: Architecture to Controls Mapping	Physical Security Threats and Exposures	9
	Web Based Application Development	1
Chapter 8: Assessment Planning and Scoping	Risk assessment in planning	1
	Setting up of Audit objectives	6
Chapter 9: Static Application Security Testing (SAST)	Web Based Application Development	1
	Vulnerability Assessment and Penetration Testing	60
Chapter 10: Dynamic Application Security Testing (DAST)	Testing	4
	Vulnerability Assessment and Penetration Testing – Penetration Testing	36
Chapter 11: Software Composition Analysis (SCA)	System Analysis	3
	Web Based Application Development	1
Chapter 12: Business Logic Flaw Audits	SDLC Need, Benefits and Phases	1
	Web Based Application Development	1
Chapter 13: Authentication & Session Security	SDLC Need, Benefits and Phases	1
	Application Access Controls	8
Chapter 14: Authorization & Access Control Testing	SDLC Need, Benefits and Phases	1
	Authorization Techniques Operating System	57
Chapter 15: Cryptography Implementation in Applications	Web Based Application Development	1
	Cryptography – Transport Layer Security	7
Chapter 16: API Security Testing	Testing	4
Chapter 17: Cloud-Native Application Security	Web Based Application Development	1
Chapter 18: Case Studies & Defect Remediation	Web Based Application Development	1
	SDLC Need, Benefits and Phases	1
	Component Based Development	3
	TOTAL ACTIVE QUESTIONS IN MODULE 7:	325