A small company develops a customer relationship management (CRM) application that handles sensitive client data. The company has no dedicated security team, and the developers are not security experts. The company wants to improve the security of the application without a large budget. Which approach should the company take?

Hire a penetration testing firm to test the application once a year and fix any issues that are found.

Purchase a commercial WAF and deploy it in front of the application, assuming it will protect the application from all vulnerabilities.

Adopt a secure SDLC framework, provide security training to developers, and use free or low-cost SAST tools in the CI pipeline.

Rely on the developers to write secure code because they are familiar with the application and its data.

An application displays user-generated comments on a public page. A security tester discovers that a comment containing ' alert(1) ' executes in other users' browsers. Which type of vulnerability is this, and what is the best fix?

SQL injection; use parameterized queries

Insecure deserialization; validate serialized objects

Stored XSS; encode output when rendering comments

A web application is behind a WAF. The security team wants to detect and block SQL injection attempts. Which WAF configuration is most appropriate?

Disable the WAF because the application uses parameterized queries

Set the WAF to log-only mode and review logs weekly

Enable a rule set that inspects query parameters for SQL injection patterns

Configure the WAF to block all POST requests

Which of the following is a common technique used in threat modeling to identify potential threats?

Running a vulnerability scanner against the production application

Decomposing the application into components and data flows to analyze entry points and trust boundaries

Reviewing application logs for suspicious activity

Performing a penetration test to exploit vulnerabilities

What is the primary purpose of rate limiting in API security?

To log all API requests for auditing purposes

To encrypt data transmitted between the API client and server

To authenticate users before they access the API

To prevent abuse and denial-of-service by limiting the number of requests a client can make in a given time period

GIAC Critical Controls Certification

Domain 6Objective 1

Application Software Security GCCC Practice Questions (Page 5)

Part of the Application and Network Security domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

10concepts

Questions 21–25

21application · medium
A small company develops a customer relationship management (CRM) application that handles sensitive client data. The company has no dedicated security team, and the developers are not security experts. The company wants to improve the security of the application without a large budget. Which approach should the company take?
Select an answer first
22application · medium
An application displays user-generated comments on a public page. A security tester discovers that a comment containing '<script>alert(1)</script>' executes in other users' browsers. Which type of vulnerability is this, and what is the best fix?
Select an answer first
23application · medium
A web application is behind a WAF. The security team wants to detect and block SQL injection attempts. Which WAF configuration is most appropriate?
Select an answer first
24foundation · easy
Which of the following is a common technique used in threat modeling to identify potential threats?
Select an answer first
25foundation · easy
What is the primary purpose of rate limiting in API security?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.

Application Software Security GCCC Practice Questions (Page 5)

Questions 21–25

An application displays user-generated comments on a public page. A security tester discovers that a comment containing '<script>alert(1)</script>' executes in other users' browsers. Which type of vulnerability is this, and what is the best fix?

A web application is behind a WAF. The security team wants to detect and block SQL injection attempts. Which WAF configuration is most appropriate?

Which of the following is a common technique used in threat modeling to identify potential threats?

What is the primary purpose of rate limiting in API security?

Keep studying — Application and Network Security