Application Software Security GCCC Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A security operations team is monitoring a web application that uses a WAF. The WAF logs show a high number of requests that match a known SQL injection signature, but the requests are being blocked. The application team reports that some legitimate users are experiencing errors. What should the security team do first?

   • ADisable the WAF rule that is blocking the requests to restore service for legitimate users.
   • BReview the WAF logs to determine whether the blocked requests are actually malicious or if the rule is causing false positives.
   • CIncrease the WAF's logging level to capture more details about the requests, and then wait for more data.
   • DContact the users who are experiencing errors and ask them to provide the exact request they sent.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which statement best describes the role of application security in protecting software?

   • AIt is a one-time assessment performed after deployment to identify vulnerabilities
   • BIt is a set of network controls that filter traffic to and from the application server
   • CIt is a set of practices applied only during the testing phase to find bugs before release
   • DIt is a continuous process of identifying, mitigating, and managing security risks in software
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is the primary purpose of application security?

   • ATo ensure applications run faster and more efficiently on production servers
   • BTo protect applications from threats throughout their lifecycle by identifying, fixing, and preventing vulnerabilities
   • CTo ensure applications are free from all possible defects and bugs
   • DTo guarantee that applications never experience any security incidents
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A DevOps team is deploying a containerized microservice to a Kubernetes cluster. The container image is built from a base image that contains several known vulnerabilities. The team wants to reduce the risk of container breakout and lateral movement. Which set of practices should the team adopt?

   • ADeploy the container to a separate namespace and enable audit logging, but do not modify the container's user or filesystem permissions.
   • BRun the container with privileged mode so it can access the host resources, and rely on the Kubernetes network policy to isolate it.
   • CUse the latest base image without scanning, and set the container's CPU and memory limits to prevent resource exhaustion.
   • DScan the image for vulnerabilities, rebuild it using a minimal base image, run the container as a non-root user, and enforce a read-only root filesystem.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A startup is building a customer-facing application and wants to embed security from the start. They have limited resources and need to prioritize. Which action best reflects application security fundamentals?

   • ATrain developers in secure coding and use a security checklist during code review
   • BFocus only on functional requirements to speed up delivery
   • CWait until the application is complete to hire a security consultant
   • DPurchase a WAF and rely on it to protect the application
   Reveal Solution Discussion Select an answer first