A DevSecOps team is building a CI/CD pipeline for a microservices application. They want to automate security checks but are concerned about slowing down the pipeline. The team has a limited budget and cannot afford expensive commercial tools. They need to catch common coding flaws, known vulnerabilities in dependencies, and misconfigurations in infrastructure as code. Which approach best meets these needs within the constraints?

Use a single open-source SAST tool and skip dependency and infrastructure scanning to save time.

Integrate open-source SAST, SCA, and infrastructure-as-code scanning tools into the pipeline, and run them in parallel on every commit.

Perform a manual security review of the entire codebase before each release.

Run a single commercial DAST tool against the production environment after each release.

An organization is decommissioning a legacy application that contains sensitive data. The application runs on a physical server that is still under warranty. The organization wants to repurpose the server for a non-sensitive workload but must also comply with a data protection regulation that requires secure deletion of personal data. Which approach best satisfies both the warranty and the regulatory requirement?

Delete the application files and empty the recycle bin.

Physically destroy the hard drives and replace them with new ones.

Reformat the hard drives and reinstall the operating system.

Perform a cryptographic erase of the storage drives, then repurpose the server.

A security tester is performing a dynamic application security test (DAST) on a web application. The tester wants to identify vulnerabilities that require user interaction, such as stored XSS. Which testing approach is most effective?

Review the application's error logs for suspicious activity.

Only perform static analysis on the source code.

Use a DAST tool that simulates user interactions, such as clicking links and submitting forms, while injecting payloads.

Test only the login page for SQL injection.

During a security code review, a reviewer notices that a C++ application uses `strcpy()` to copy user input into a fixed-size buffer. Which of the following is the most appropriate recommendation to prevent a buffer overflow?

Ignore the issue because buffer overflows are only a problem in older systems.

Increase the buffer size to a very large value to accommodate any input.

Use `gets()` instead of `strcpy()` to read input directly.

Replace `strcpy()` with `strncpy()` and ensure the buffer size is always passed correctly.

GIAC Information Security Professional

Domain 3Objective 3

Software Development Security GISP Practice Questions (Page 6)

Part of the Access, Testing, and Development domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~29–50 in this domain), expect 10–17 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

9concepts

Questions 26–30

26foundation · easy
Which SDLC phase typically includes activities such as code review, static analysis, and unit testing to identify and fix security flaws early?
Select an answer first
27expert · hard
A DevSecOps team is building a CI/CD pipeline for a microservices application. They want to automate security checks but are concerned about slowing down the pipeline. The team has a limited budget and cannot afford expensive commercial tools. They need to catch common coding flaws, known vulnerabilities in dependencies, and misconfigurations in infrastructure as code. Which approach best meets these needs within the constraints?
Select an answer first
28expert · hard
An organization is decommissioning a legacy application that contains sensitive data. The application runs on a physical server that is still under warranty. The organization wants to repurpose the server for a non-sensitive workload but must also comply with a data protection regulation that requires secure deletion of personal data. Which approach best satisfies both the warranty and the regulatory requirement?
Select an answer first
29application · medium
A security tester is performing a dynamic application security test (DAST) on a web application. The tester wants to identify vulnerabilities that require user interaction, such as stored XSS. Which testing approach is most effective?
Select an answer first
30application · medium
During a security code review, a reviewer notices that a C++ application uses `strcpy()` to copy user input into a fixed-size buffer. Which of the following is the most appropriate recommendation to prevent a buffer overflow?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISP” is a trademark of its owner, used for identification only.

Software Development Security GISP Practice Questions (Page 6)

Questions 26–30

Which SDLC phase typically includes activities such as code review, static analysis, and unit testing to identify and fix security flaws early?

A security tester is performing a dynamic application security test (DAST) on a web application. The tester wants to identify vulnerabilities that require user interaction, such as stored XSS. Which testing approach is most effective?

During a security code review, a reviewer notices that a C++ application uses `strcpy()` to copy user input into a fixed-size buffer. Which of the following is the most appropriate recommendation to prevent a buffer overflow?

Keep studying — Access, Testing, and Development