A company is starting a new software project and wants to integrate security into the development process from the beginning. The project manager is concerned that adding security activities will slow down the team. Which approach should the security lead recommend to balance security and speed?

Purchase a WAF and deploy it in front of the application after release, assuming that it will protect the application from all vulnerabilities.

Defer all security activities until the end of the project and then run a single comprehensive penetration test before release.

Rely on the developers to write secure code without any formal process, and only review security after a vulnerability is reported in production.

Incorporate threat modeling during the design phase, use secure coding standards during implementation, and run automated SAST in the CI pipeline.

What is the primary goal of application security monitoring?

To detect security events and anomalies in application behavior in real time

To prevent all security incidents from occurring

To automatically patch vulnerabilities without human intervention

To replace the need for application security testing

A team is threat modeling a new payment processing application. They draw a data flow diagram and identify that cardholder data flows from the web tier to the application tier over an internal network. Which threat modeling question is most relevant to assess this flow?

Is the data encrypted in transit between tiers?

Is the application code written in a compiled language?

Are the servers running the latest OS patches?

What is the primary difference between static application security testing (SAST) and dynamic application security testing (DAST)?

SAST tests for runtime issues, while DAST tests for code quality issues

SAST requires authentication, while DAST does not

SAST analyzes source code without executing it, while DAST tests the running application from the outside

SAST is performed after deployment, while DAST is performed during development

GIAC Critical Controls Certification

Domain 6Objective 1

Application Software Security GCCC Practice Questions (Page 4)

Part of the Application and Network Security domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

10concepts

Questions 16–20

16application · medium
A company is starting a new software project and wants to integrate security into the development process from the beginning. The project manager is concerned that adding security activities will slow down the team. Which approach should the security lead recommend to balance security and speed?
Select an answer first
17foundation · easy
What is the first step in an effective incident response process for an application security event?
Select an answer first
18foundation · easy
What is the primary goal of application security monitoring?
Select an answer first
19application · medium
A team is threat modeling a new payment processing application. They draw a data flow diagram and identify that cardholder data flows from the web tier to the application tier over an internal network. Which threat modeling question is most relevant to assess this flow?
Select an answer first
20foundation · easy
What is the primary difference between static application security testing (SAST) and dynamic application security testing (DAST)?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.