A software development team is using an agile methodology with two-week sprints. The security team wants to integrate security into the SDLC without disrupting the fast-paced development cycle. The team has limited security staff and cannot conduct full threat modeling sessions for every feature. Which approach best integrates security into the agile SDLC while respecting the team's constraints?

Require a full threat modeling session for every user story before development begins.

Hire additional security staff to conduct manual code reviews of every commit.

Perform lightweight threat modeling for high-risk features and automate security testing in the CI/CD pipeline.

Defer all security testing until the end of the project and perform a single penetration test.

A development team is starting a new web application project. The security lead wants to ensure that security requirements are considered from the very beginning and that potential threats are identified before any code is written. Which action best aligns with integrating security into the early phases of the SDLC?

Run a dynamic application security test after the application is deployed to production.

Conduct a threat modeling session during the requirements and design phase.

Deploy a web application firewall to protect the application after launch.

Perform a security code review just before the final release.

What is a primary risk associated with using third-party libraries and open-source components in software development?

They may contain known vulnerabilities that are not patched or updated

They are always less secure than custom code

They always require a paid license

They cannot be used in regulated industries

A software team has just completed writing a new authentication module. The security lead wants to identify common coding flaws such as buffer overflows and injection vulnerabilities before the module is integrated into the main application. Which testing method is most appropriate at this stage?

Run a static application security testing (SAST) tool on the source code.

Deploy the module to production and monitor for anomalies.

Conduct a manual penetration test on the fully integrated application.

Perform a dynamic application security testing (DAST) scan against the running module.

GIAC Information Security Professional

Domain 3Objective 3

Software Development Security GISP Practice Questions (Page 11)

Part of the Access, Testing, and Development domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~29–50 in this domain), expect 10–17 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

9concepts

Questions 51–55

51expert · hard
A software development team is using an agile methodology with two-week sprints. The security team wants to integrate security into the SDLC without disrupting the fast-paced development cycle. The team has limited security staff and cannot conduct full threat modeling sessions for every feature. Which approach best integrates security into the agile SDLC while respecting the team's constraints?
Select an answer first
52application · medium
A development team is starting a new web application project. The security lead wants to ensure that security requirements are considered from the very beginning and that potential threats are identified before any code is written. Which action best aligns with integrating security into the early phases of the SDLC?
Select an answer first
53foundation · easy
What is a primary risk associated with using third-party libraries and open-source components in software development?
Select an answer first
54application · medium
A software team has just completed writing a new authentication module. The security lead wants to identify common coding flaws such as buffer overflows and injection vulnerabilities before the module is integrated into the main application. Which testing method is most appropriate at this stage?
Select an answer first
55foundation · easy
Which type of security testing analyzes the source code or binary without executing the program, looking for patterns that indicate known vulnerabilities?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISP” is a trademark of its owner, used for identification only.

Software Development Security GISP Practice Questions (Page 11)

Questions 51–55

What is a primary risk associated with using third-party libraries and open-source components in software development?

A software team has just completed writing a new authentication module. The security lead wants to identify common coding flaws such as buffer overflows and injection vulnerabilities before the module is integrated into the main application. Which testing method is most appropriate at this stage?

Which type of security testing analyzes the source code or binary without executing the program, looking for patterns that indicate known vulnerabilities?

Keep studying — Access, Testing, and Development