A software development team is adopting a secure SDLC. They want to identify and remediate security flaws early in the development process, before code is deployed. Which combination of activities best achieves this goal?

Review the code only after a security incident occurs.

Conduct a penetration test after the application is deployed to production.

Run dynamic application security testing (DAST) against the production environment after release.

Perform threat modeling during design and run static application security testing (SAST) on the code before release.

A company is designing a secure messaging system. They want to ensure that messages are confidential, authentic, and non-repudiable. Which combination of cryptographic mechanisms should they use?

Hash the messages and send the hash

Use only the sender's private key to encrypt

Encrypt messages with a symmetric key and send the key in the same message

Encrypt messages with the recipient's public key and sign with the sender's private key

GIAC Information Security Professional

Domain 2Objective 1

Security Architecture and Engineering GISP Practice Questions (Page 4)

Part of the Security Architecture and Operations domain, which makes up ~43% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~41–69 in this domain), expect 14–23 from this objective — we provide 65 practice questions to prepare you well beyond it. (estimate)

65questions here

13free pages

12concepts

Questions 16–20

16application · medium
A software development team is adopting a secure SDLC. They want to identify and remediate security flaws early in the development process, before code is deployed. Which combination of activities best achieves this goal?
Select an answer first
17foundation · easy
Which design principle states that a system should be configured to deny access by default?
Select an answer first
18foundation · easy
In which phase of the system development lifecycle (SDLC) should security requirements first be identified?
Select an answer first
19application · medium
A company is implementing a new security architecture. The security team wants to ensure that no single person can approve and execute a high-value financial transaction. Which principle should be applied?
Select an answer first
20expert · hard
A company is designing a secure messaging system. They want to ensure that messages are confidential, authentic, and non-repudiable. Which combination of cryptographic mechanisms should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISP” is a trademark of its owner, used for identification only.

Security Architecture and Engineering GISP Practice Questions (Page 4)

Questions 16–20

A software development team is adopting a secure SDLC. They want to identify and remediate security flaws early in the development process, before code is deployed. Which combination of activities best achieves this goal?

Which design principle states that a system should be configured to deny access by default?

In which phase of the system development lifecycle (SDLC) should security requirements first be identified?

A company is implementing a new security architecture. The security team wants to ensure that no single person can approve and execute a high-value financial transaction. Which principle should be applied?

A company is designing a secure messaging system. They want to ensure that messages are confidential, authentic, and non-repudiable. Which combination of cryptographic mechanisms should they use?

Keep studying — Security Architecture and Operations