mediumMultiple ChoiceObjective-mapped
200-201 Practice Question: Deploying a new web application and wants to…
A company is deploying a new web application and wants to ensure it is secure against common web attacks. Which of the following is the most effective approach to validate the security of the application before going live?
⚠ Common exam trap
Cisco often tests the distinction between validation (penetration test) and mitigation (WAF), trapping candidates who think a WAF or vulnerability scanner alone can fully validate application security before deployment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conduct a penetration test by an external firm
A penetration test by an external firm is the most effective approach because it simulates a real-world attack, combining automated tools and manual exploitation techniques to identify vulnerabilities that automated scanners or static analysis might miss. Unlike a vulnerability scanner, a penetration test actively attempts to bypass security controls, test business logic flaws, and chain multiple low-risk issues into a critical exploit, providing a holistic validation of the application's security posture before going live.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Conduct a penetration test by an external firm
Why this is correct
Penetration testing simulates real attacks and uncovers vulnerabilities that automated tools might miss.
- ✗
Run a vulnerability scanner against the application
Why it's wrong here
Vulnerability scanners may produce false positives and miss logic flaws; they are not as thorough as manual testing.
- ✗
Implement a web application firewall (WAF)
Why it's wrong here
A WAF is a protective control, not a validation method; it does not find vulnerabilities.
- ✗
Perform a code review with static analysis tools
Why it's wrong here
Code review and static analysis are important but may not catch runtime vulnerabilities; dynamic testing is needed.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.