A company is designing a new web application that will handle customer payment data. The architecture includes a public-facing load balancer, application servers, a database, and an internal admin interface. Which threat modeling approach would best help the team prioritize risks during the design phase?

Interview the development team about potential security issues and document their concerns.

Run a vulnerability scanner against the production environment after deployment.

Review the OWASP Top 10 list and patch any known vulnerabilities in the framework.

Draw a data flow diagram and apply STRIDE to each component and trust boundary.

A security team needs to identify vulnerabilities in a new containerized application environment. The environment is dynamic, with containers being created and destroyed frequently. Which approach would provide the most accurate and continuous vulnerability identification?

Scan container images in the registry and integrate scanning into the CI/CD pipeline.

Run a periodic network scan of the container hosts.

Perform a one-time penetration test of the container environment.

Manually review the Dockerfiles for known vulnerabilities.

A security team is overwhelmed by the number of vulnerability alerts from multiple sources. They want to reduce noise and focus on the most relevant threats. Which approach would best achieve this?

Use a single threat intelligence feed without filtering.

Correlate vulnerability data with threat intelligence that is filtered by the organization's industry and asset profile.

Rely on the vendor's default risk ratings for all vulnerabilities.

Turn off all vulnerability alerts except for critical severity.

What is the primary goal of a remediation plan?

To document the organization's incident response procedures

To eliminate or mitigate prioritized vulnerabilities

To identify all vulnerabilities in the environment

To assign CVSS scores to vulnerabilities

GIAC Cyber Incident Leader

Domain 2Objective 3

Vulnerability and Threat Management GCIL Practice Questions (Page 6)

Part of the Incident Preparation and Prevention domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 3–5 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

8concepts

Questions 26–30

26application · medium
A company is designing a new web application that will handle customer payment data. The architecture includes a public-facing load balancer, application servers, a database, and an internal admin interface. Which threat modeling approach would best help the team prioritize risks during the design phase?
Select an answer first
27application · medium
A security team needs to identify vulnerabilities in a new containerized application environment. The environment is dynamic, with containers being created and destroyed frequently. Which approach would provide the most accurate and continuous vulnerability identification?
Select an answer first
28expert · hard
A security team is overwhelmed by the number of vulnerability alerts from multiple sources. They want to reduce noise and focus on the most relevant threats. Which approach would best achieve this?
Select an answer first
29foundation · easy
What is the primary goal of a remediation plan?
Select an answer first
30foundation · easy
Which vulnerability assessment output is used to communicate the relative severity of a vulnerability in a standardized, vendor-neutral way?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.

Vulnerability and Threat Management GCIL Practice Questions (Page 6)

Questions 26–30

A security team needs to identify vulnerabilities in a new containerized application environment. The environment is dynamic, with containers being created and destroyed frequently. Which approach would provide the most accurate and continuous vulnerability identification?

A security team is overwhelmed by the number of vulnerability alerts from multiple sources. They want to reduce noise and focus on the most relevant threats. Which approach would best achieve this?

What is the primary goal of a remediation plan?

Which vulnerability assessment output is used to communicate the relative severity of a vulnerability in a standardized, vendor-neutral way?

Keep studying — Incident Preparation and Prevention