In a traditional Waterfall Software Development Life Cycle (SDLC), at which phase is it most appropriate to first formally integrate security requirements and perform threat modeling?

Requirements gathering and analysis

A DevOps team wants to incorporate security testing into their CI/CD pipeline without slowing down the build process significantly. They need to catch common coding flaws early and also check for known vulnerabilities in third-party libraries. Which combination of automated checks would best achieve this?

Run a full penetration test against a staging environment after every build.

Perform a manual code review of every commit before merging.

Deploy to production and then run a dynamic application security test (DAST) tool.

Run a static application security testing (SAST) tool and a software composition analysis (SCA) tool on every build.

A development team is writing a C++ application that processes untrusted binary data. A code review identifies a potential buffer overflow in a function that copies data into a fixed-size array. The team is under pressure to release quickly. Which remediation is most secure and practical?

Increase the size of the array to accommodate larger inputs.

Replace the unsafe function with a bounds-checked version that validates the input length before copying.

Use a static analysis tool to identify the vulnerability but defer the fix to the next release.

Add compiler flags that enable stack canaries and other hardening features.

An organization is preparing to release a new version of its web application. The release process currently involves manually copying files to production servers and running database scripts by hand. The security team wants to ensure that the deployment is secure and repeatable. Which practice should be implemented first?

Create an automated deployment pipeline that uses infrastructure as code and enforces security checks before release.

Increase the number of manual reviews performed by senior administrators before each release.

Perform the deployment during off-peak hours to minimize user impact.

Disable all security controls during the deployment to avoid interference.

A project manager is planning a new software project and wants to integrate security throughout the SDLC. The team is currently gathering requirements. Which security activity is most appropriate for this phase?

Define security requirements and conduct a preliminary threat model to identify high-level risks.

Deploy the application to production and monitor for security incidents.

Write the final security documentation and user manuals.

Perform a full penetration test on the system after it is built.

GIAC Information Security Professional

Domain 3Objective 3

Software Development Security GISP Practice Questions (Page 5)

Part of the Access, Testing, and Development domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~29–50 in this domain), expect 10–17 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

9concepts

Questions 21–25

21foundation · easy
In a traditional Waterfall Software Development Life Cycle (SDLC), at which phase is it most appropriate to first formally integrate security requirements and perform threat modeling?
Select an answer first
22application · medium
A DevOps team wants to incorporate security testing into their CI/CD pipeline without slowing down the build process significantly. They need to catch common coding flaws early and also check for known vulnerabilities in third-party libraries. Which combination of automated checks would best achieve this?
Select an answer first
23expert · hard
A development team is writing a C++ application that processes untrusted binary data. A code review identifies a potential buffer overflow in a function that copies data into a fixed-size array. The team is under pressure to release quickly. Which remediation is most secure and practical?
Select an answer first
24application · medium
An organization is preparing to release a new version of its web application. The release process currently involves manually copying files to production servers and running database scripts by hand. The security team wants to ensure that the deployment is secure and repeatable. Which practice should be implemented first?
Select an answer first
25application · medium
A project manager is planning a new software project and wants to integrate security throughout the SDLC. The team is currently gathering requirements. Which security activity is most appropriate for this phase?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISP” is a trademark of its owner, used for identification only.

Software Development Security GISP Practice Questions (Page 5)

Questions 21–25

In a traditional Waterfall Software Development Life Cycle (SDLC), at which phase is it most appropriate to first formally integrate security requirements and perform threat modeling?

A development team is writing a C++ application that processes untrusted binary data. A code review identifies a potential buffer overflow in a function that copies data into a fixed-size array. The team is under pressure to release quickly. Which remediation is most secure and practical?

A project manager is planning a new software project and wants to integrate security throughout the SDLC. The team is currently gathering requirements. Which security activity is most appropriate for this phase?

Keep studying — Access, Testing, and Development