A security team must assess a portfolio of 40 applications. The team has only enough staff to deeply test 8 applications this quarter. The applications include a public-facing customer portal, an internal HR system, a legacy inventory tool with no known internet exposure, and a partner-facing API. Which approach best aligns with risk-based testing principles?

Test the 8 applications that are easiest to access, because they can be assessed quickly with minimal disruption.

Test the 8 applications that have the most lines of code, because larger codebases usually contain more vulnerabilities.

Test the 8 applications that have the most regulatory compliance requirements, regardless of their exposure.

Select the 8 applications with the highest combined likelihood of exploitation and potential business impact, prioritizing the customer portal and partner API.

What is the primary purpose of a security assessment within an organization?

To identify and evaluate security weaknesses and risks in systems and processes

To provide a one-time certification that the organization is fully secure

To replace the need for ongoing security monitoring and incident response

To guarantee that all security controls are perfectly implemented and cannot be bypassed

What is the core principle of risk-based testing?

Testing all features equally regardless of risk

Testing only after a security incident occurs

Using only automated tools to minimize manual effort

Prioritizing testing efforts based on the likelihood and impact of potential threats

An organization is preparing for a compliance audit that requires evidence of regular security testing. The audit also requires that any high-risk findings be remediated within 30 days. The security team has a backlog of high-risk findings from the last test. What is the best course of action?

Mark the high-risk findings as 'accepted risk' without further action to close them out.

Prioritize remediation of the existing high-risk findings, document the remediation status, and schedule the next test after the current findings are addressed.

Run the next test immediately to show the auditor that testing is ongoing, even if the backlog remains.

Ask the auditor to waive the 30-day remediation requirement because the team is understaffed.

What is the primary characteristic of static analysis in security testing?

It tests the application while it is running

It requires a fully deployed production environment

It relies solely on manual review of documentation

It examines source code or binaries without executing the application

GIAC Information Security Professional

Domain 3Objective 2

Security Assessment and Testing GISP Practice Questions (Page 4)

Part of the Access, Testing, and Development domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~29–50 in this domain), expect 10–17 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

7concepts

Questions 16–20

16application · medium
A security team must assess a portfolio of 40 applications. The team has only enough staff to deeply test 8 applications this quarter. The applications include a public-facing customer portal, an internal HR system, a legacy inventory tool with no known internet exposure, and a partner-facing API. Which approach best aligns with risk-based testing principles?
Select an answer first
17foundation · easy
What is the primary purpose of a security assessment within an organization?
Select an answer first
18foundation · easy
What is the core principle of risk-based testing?
Select an answer first
19expert · hard
An organization is preparing for a compliance audit that requires evidence of regular security testing. The audit also requires that any high-risk findings be remediated within 30 days. The security team has a backlog of high-risk findings from the last test. What is the best course of action?
Select an answer first
20foundation · easy
What is the primary characteristic of static analysis in security testing?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISP” is a trademark of its owner, used for identification only.