A development team is writing a web application that allows users to upload profile pictures. The application stores the files on the server and serves them back to users. The security team is concerned about the risk of uploading malicious files that could be executed on the server or served to other users. Which combination of controls would best mitigate this risk?

Validate the file type by content, store files outside the web root, and serve them with a Content-Disposition header.

Store files in the web root and rely on antivirus scanning on the server.

Allow any file type but rename the file with a random extension.

Only accept files with a .jpg extension and trust the user's file extension.

A security team is testing a web application for common vulnerabilities. They want to identify as many potential issues as possible without requiring a fully authenticated session, and they need results quickly. Which testing approach is most appropriate for this initial assessment?

Run an automated dynamic application security testing (DAST) tool against the application.

Conduct a static application security testing (SAST) scan on the production binaries.

Perform a manual penetration test with full credentials and a detailed test plan.

Review the application's architecture and design documents for security flaws.

A company is moving to a continuous delivery model and wants to ensure that only signed and approved code is deployed to production. Which control should be implemented in the deployment pipeline?

Deploy code directly from a developer's workstation to production.

Allow any developer to manually trigger a production deployment after a code review.

Use a shared admin account to deploy code to production.

Require code signing and verify signatures as part of the automated release process.

What is the primary purpose of a security-focused code review?

To measure the performance of the application under load

To identify and remediate security flaws in source code before deployment

To verify that the code meets functional requirements

To ensure the code is formatted according to style guidelines

A company is developing a new application and plans to use several third-party libraries. The security team has identified that one of the libraries has a known vulnerability, but it is widely used and a patched version is expected soon. The project timeline is tight, and the team cannot wait for the patch. Which action best balances the need to proceed with development and the need to manage supply chain risk?

Use the library and do not inform the development team about the vulnerability.

Delay the entire project until the patched version is released.

Use the library but implement compensating controls and monitor for the release of a patched version.

Abandon the library and rewrite all functionality using internal code.

GIAC Information Security Professional

Domain 3Objective 3

Software Development Security GISP Practice Questions (Page 1)

Part of the Access, Testing, and Development domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~29–50 in this domain), expect 10–17 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

9concepts

Questions 1–5

1expert · hard
A development team is writing a web application that allows users to upload profile pictures. The application stores the files on the server and serves them back to users. The security team is concerned about the risk of uploading malicious files that could be executed on the server or served to other users. Which combination of controls would best mitigate this risk?
Select an answer first
2application · medium
A security team is testing a web application for common vulnerabilities. They want to identify as many potential issues as possible without requiring a fully authenticated session, and they need results quickly. Which testing approach is most appropriate for this initial assessment?
Select an answer first
3application · medium
A company is moving to a continuous delivery model and wants to ensure that only signed and approved code is deployed to production. Which control should be implemented in the deployment pipeline?
Select an answer first
4foundation · easy
What is the primary purpose of a security-focused code review?
Select an answer first
5expert · hard
A company is developing a new application and plans to use several third-party libraries. The security team has identified that one of the libraries has a known vulnerability, but it is widely used and a patched version is expected soon. The project timeline is tight, and the team cannot wait for the patch. Which action best balances the need to proceed with development and the need to manage supply chain risk?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISP” is a trademark of its owner, used for identification only.