What is the primary purpose of threat modeling in application security?

To test the application for vulnerabilities after it is deployed

To monitor application logs for security incidents in real time

To ensure the application meets performance requirements

To identify and prioritize potential threats to an application so that mitigations can be designed

A developer is writing code that queries a database using user input. The team has a policy to prevent SQL injection. Which coding practice is most effective?

Use dynamic SQL with string concatenation

Escape single quotes in user input

Use parameterized queries or prepared statements

Validate input with a blocklist of SQL keywords

A security team is evaluating testing tools for a web application that has a complex JavaScript front-end and a REST API backend. They want to identify vulnerabilities that require authenticated user interactions, such as stored XSS. Which testing approach is most effective for this scenario?

Run a SAST tool on the backend source code only

Deploy a WAF with OWASP Core Rule Set and monitor logs

Run a DAST tool that supports session management and can crawl authenticated pages

Perform manual penetration testing without automated tools

In a secure software development lifecycle (SSDLC), at which phase should security requirements be first defined?

During the requirements gathering phase

What is a key security consideration when using container images in a containerized application?

Scanning images for known vulnerabilities before deployment

Disabling all logging inside containers to reduce overhead

Ensuring that images are stored in a public registry for transparency

Running containers with root privileges to ensure they have full access

GIAC Critical Controls Certification

Domain 6Objective 1

Application Software Security GCCC Practice Questions (Page 2)

Part of the Application and Network Security domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

10concepts

Questions 6–10

6foundation · easy
What is the primary purpose of threat modeling in application security?
Select an answer first
7application · medium
A developer is writing code that queries a database using user input. The team has a policy to prevent SQL injection. Which coding practice is most effective?
Select an answer first
8application · medium
A security team is evaluating testing tools for a web application that has a complex JavaScript front-end and a REST API backend. They want to identify vulnerabilities that require authenticated user interactions, such as stored XSS. Which testing approach is most effective for this scenario?
Select an answer first
9foundation · easy
In a secure software development lifecycle (SSDLC), at which phase should security requirements be first defined?
Select an answer first
10foundation · easy
What is a key security consideration when using container images in a containerized application?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.