A company is designing a public API for partner integrations. They want to ensure that only authorized partners can access specific resources and that abuse is limited. Which combination of controls is most appropriate?

Allow all requests and rely on the WAF to filter malicious traffic

Use basic authentication with username/password for each partner

Use a shared API key for all partners and no rate limiting

Use OAuth 2.0 with scopes and implement rate limiting per client

Which of the following is a best practice for securing an API?

Disabling HTTPS to improve performance

Implementing proper authentication and authorization for every API endpoint

Exposing detailed error messages to help clients debug issues

Using API keys as the sole method of authentication for all requests

Which of the following is a key characteristic of a secure software development lifecycle (SSDLC)?

Security is the sole responsibility of the security team, not developers

The primary goal is to speed up development by reducing security reviews

Security activities are performed only after the application is fully developed

Security controls are integrated into every phase of the development process

What is the primary purpose of input validation in secure coding?

To ensure that all user input conforms to expected formats and constraints before processing

To log all user inputs for auditing purposes

To improve the performance of the application by reducing processing time

To encrypt all data transmitted between the client and server

A company runs a legacy web application that cannot be patched quickly. The security team has identified that the application is vulnerable to SQL injection and cross-site scripting. The team wants to reduce the risk of exploitation while the development team works on a fix. Which control should the team implement first?

Disable JavaScript in all client browsers that access the application to prevent XSS payloads from executing.

Run a full DAST scan and fix every vulnerability that is reported before allowing any further access to the application.

Deploy a WAF with rules that block common SQL injection and XSS payloads, and enable logging and alerting on blocked requests.

Move the application to a private network and require all users to connect via VPN, assuming that only trusted users will access it.

GIAC Critical Controls Certification

Domain 6Objective 1

Application Software Security GCCC Practice Questions (Page 6)

Part of the Application and Network Security domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

10concepts

Questions 26–30

26application · medium
A company is designing a public API for partner integrations. They want to ensure that only authorized partners can access specific resources and that abuse is limited. Which combination of controls is most appropriate?
Select an answer first
27foundation · easy
Which of the following is a best practice for securing an API?
Select an answer first
28foundation · easy
Which of the following is a key characteristic of a secure software development lifecycle (SSDLC)?
Select an answer first
29foundation · easy
What is the primary purpose of input validation in secure coding?
Select an answer first
30application · medium
A company runs a legacy web application that cannot be patched quickly. The security team has identified that the application is vulnerable to SQL injection and cross-site scripting. The team wants to reduce the risk of exploitation while the development team works on a fix. Which control should the team implement first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.