A development team is building a web application that allows users to search for products. The application is currently vulnerable to SQL injection. The team wants to fix the vulnerability without changing the application's functionality. Which remediation is most effective?

Use parameterized queries for all database access

Add a web application firewall (WAF) in front of the application

Disable error messages that reveal database details

Encode all user input before including it in SQL statements

A financial services company is designing a system to prevent conflicts of interest between its investment banking and research departments. They need to ensure that an analyst in the research department cannot access information from the investment banking department for a competing client. Which security model is most appropriate?

Brewer-Nash (Chinese Wall) model

An organization is setting up a PKI to issue certificates to employees for email signing and encryption. They want to ensure that certificates can be revoked if an employee's private key is compromised. What must be implemented?

A certificate signing request (CSR) process

A hardware security module (HSM) to generate key pairs

A key escrow service that stores all private keys

A certificate revocation list (CRL) or Online Certificate Status Protocol (OCSP) responder

A software company is developing a new product and wants to integrate security into the SDLC. They have limited budget and need to choose between implementing a security champion program, conducting regular penetration tests, or purchasing a static analysis tool. Which approach is most effective for early vulnerability detection within a limited budget?

Rely on code reviews by senior developers

Implement a security champion program to train developers

Conduct regular penetration tests after each release

Purchase a static analysis tool and integrate it into the CI pipeline

GIAC Information Security Professional

Domain 2Objective 1

Security Architecture and Engineering GISP Practice Questions (Page 5)

Part of the Security Architecture and Operations domain, which makes up ~43% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~41–69 in this domain), expect 14–23 from this objective — we provide 65 practice questions to prepare you well beyond it. (estimate)

65questions here

13free pages

12concepts

Questions 21–25

21expert · hard
A development team is building a web application that allows users to search for products. The application is currently vulnerable to SQL injection. The team wants to fix the vulnerability without changing the application's functionality. Which remediation is most effective?
Select an answer first
22expert · hard
A financial services company is designing a system to prevent conflicts of interest between its investment banking and research departments. They need to ensure that an analyst in the research department cannot access information from the investment banking department for a competing client. Which security model is most appropriate?
Select an answer first
23application · medium
An organization is setting up a PKI to issue certificates to employees for email signing and encryption. They want to ensure that certificates can be revoked if an employee's private key is compromised. What must be implemented?
Select an answer first
24expert · hard
A software company is developing a new product and wants to integrate security into the SDLC. They have limited budget and need to choose between implementing a security champion program, conducting regular penetration tests, or purchasing a static analysis tool. Which approach is most effective for early vulnerability detection within a limited budget?
Select an answer first
25foundation · easy
An organization deploys an intrusion detection system (IDS) to monitor network traffic for suspicious activity. This is an example of which type of security control?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISP” is a trademark of its owner, used for identification only.

Security Architecture and Engineering GISP Practice Questions (Page 5)

Questions 21–25

A development team is building a web application that allows users to search for products. The application is currently vulnerable to SQL injection. The team wants to fix the vulnerability without changing the application's functionality. Which remediation is most effective?

An organization is setting up a PKI to issue certificates to employees for email signing and encryption. They want to ensure that certificates can be revoked if an employee's private key is compromised. What must be implemented?

An organization deploys an intrusion detection system (IDS) to monitor network traffic for suspicious activity. This is an example of which type of security control?

Keep studying — Security Architecture and Operations