During threat modeling for an e-commerce application, the team identifies that the 'order status' endpoint returns verbose error messages that reveal database schema details. Which threat modeling step should the team take next to address this finding?

Document the finding and move to the next threat

Deploy a WAF to block error messages

Prioritize the finding and add a control to sanitize error messages

Immediately rewrite the endpoint to remove error details

A security analyst notices a spike in 500 errors from a web application, followed by an alert from the WAF about a possible SQL injection attempt. The analyst checks the application logs and sees a query that contains an unexpected UNION SELECT statement. Which immediate action should the analyst take?

Block the source IP address in the WAF and consider the incident resolved because the attack was blocked.

Run a full DAST scan against the application to identify all SQL injection points before taking any other action.

Restart the application immediately to clear the error state, and then continue monitoring for additional alerts.

Isolate the affected application instance, preserve the logs and WAF alerts as evidence, and then investigate the source of the malicious request.

A web application's WAF logs show a high volume of requests to a login endpoint with different usernames and passwords from a single IP. The requests are not blocked by current rules. What should the security team do first?

Ignore the traffic because it is likely a load test

Increase the WAF logging level to collect more data

Create a WAF rule to block the IP and enable rate limiting on the login endpoint

Disable the login endpoint temporarily

A software company is adopting a Secure Software Development Lifecycle (SSDLC). They want to integrate security controls early and continuously. Which approach best aligns with SSDLC principles?

Perform a single penetration test just before release

Use only automated tools without manual review

Rely on the security team to review code after deployment

Conduct threat modeling during design and run SAST in the CI pipeline

A developer is writing a function that constructs a SQL query by concatenating user input directly into the statement. A SAST tool flags this as a SQL injection vulnerability. Which remediation should the developer apply?

Add a comment to the code explaining that the input is sanitized elsewhere and mark the SAST finding as a false positive.

Encode the user input using HTML entities before concatenating it into the SQL query.

Use a regular expression to remove any characters that are commonly used in SQL injection, such as single quotes and semicolons.

Replace the dynamic query with a parameterized query or prepared statement that passes user input as bound parameters.

GIAC Critical Controls Certification

Domain 6Objective 1

Application Software Security GCCC Practice Questions (Page 8)

Part of the Application and Network Security domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

10concepts

Questions 36–40

36application · medium
During threat modeling for an e-commerce application, the team identifies that the 'order status' endpoint returns verbose error messages that reveal database schema details. Which threat modeling step should the team take next to address this finding?
Select an answer first
37application · medium
A security analyst notices a spike in 500 errors from a web application, followed by an alert from the WAF about a possible SQL injection attempt. The analyst checks the application logs and sees a query that contains an unexpected UNION SELECT statement. Which immediate action should the analyst take?
Select an answer first
38application · medium
A web application's WAF logs show a high volume of requests to a login endpoint with different usernames and passwords from a single IP. The requests are not blocked by current rules. What should the security team do first?
Select an answer first
39application · medium
A software company is adopting a Secure Software Development Lifecycle (SSDLC). They want to integrate security controls early and continuously. Which approach best aligns with SSDLC principles?
Select an answer first
40application · medium
A developer is writing a function that constructs a SQL query by concatenating user input directly into the statement. A SAST tool flags this as a SQL injection vulnerability. Which remediation should the developer apply?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.