A security operations team notices a spike in 401 errors from a web application, followed by a successful login from an unusual geographic location. They suspect a credential-stuffing attack. Which immediate response action is most appropriate?

Increase the rate limit for API calls to reduce user friction

Block the source IP addresses and force a password reset for the affected account

Ignore the event because 401 errors are normal

Disable the WAF rule that is generating false positives

A security team is reviewing a Kubernetes cluster that runs multiple microservices. They want to detect anomalous behavior within containers. Which approach is most effective?

Run a vulnerability scanner once a month

Enable Kubernetes audit logging only

Review container images manually before deployment

Deploy a runtime security tool that monitors container processes and network activity

A threat modeling session for a healthcare application identifies that patient data is stored in a database and accessed by multiple services. The team must prioritize threats based on risk. Which threat should be addressed first?

A verbose error message that reveals database schema

A denial-of-service vulnerability in a public-facing login page

A SQL injection vulnerability in a low-privilege service that can access patient data

A misconfigured CORS policy that allows a single trusted domain

A company is developing a new mobile application that processes payment information. The project is in the requirements phase. The security team wants to ensure that security is considered throughout the project. Which activity should the team perform during the requirements phase?

Define security requirements, such as encryption of payment data in transit and at rest, and include them in the functional requirements document.

Perform a penetration test on the mobile application to identify security weaknesses.

Deploy a WAF in front of the mobile application's backend API to protect it from attacks.

Run a SAST scan on the code that has been written so far to identify any vulnerabilities.

Which of the following is a security best practice for an orchestration platform like Kubernetes?

Disabling network policies to allow unrestricted communication between pods

Using role-based access control (RBAC) to limit user permissions

Storing secrets in plain text in the container image

Granting all users cluster-admin privileges to simplify management

GIAC Critical Controls Certification

Domain 6Objective 1

Application Software Security GCCC Practice Questions (Page 7)

Part of the Application and Network Security domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

10concepts

Questions 31–35

31application · medium
A security operations team notices a spike in 401 errors from a web application, followed by a successful login from an unusual geographic location. They suspect a credential-stuffing attack. Which immediate response action is most appropriate?
Select an answer first
32application · medium
A security team is reviewing a Kubernetes cluster that runs multiple microservices. They want to detect anomalous behavior within containers. Which approach is most effective?
Select an answer first
33expert · hard
A threat modeling session for a healthcare application identifies that patient data is stored in a database and accessed by multiple services. The team must prioritize threats based on risk. Which threat should be addressed first?
Select an answer first
34application · medium
A company is developing a new mobile application that processes payment information. The project is in the requirements phase. The security team wants to ensure that security is considered throughout the project. Which activity should the team perform during the requirements phase?
Select an answer first
35foundation · easy
Which of the following is a security best practice for an orchestration platform like Kubernetes?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.