A company is decommissioning a cloud-based application that used a customer-managed encryption key (CMEK) to encrypt data at rest. The data is stored in a cloud storage bucket. The company wants to ensure that the data is irrecoverable after decommissioning. Which action is most effective?

Delete the customer-managed encryption key, then delete the storage bucket and verify that no backups remain.

Change the encryption key to a new one and keep the old key for recovery.

Move the data to a cold storage tier and leave it there.

Delete the storage bucket only, assuming the data is gone.

A security team is planning a penetration test for a web application that handles sensitive financial data. The application is in production and cannot be taken offline. The team has a limited time window and must minimize the risk of disrupting business operations. Which testing approach best balances thoroughness with the need to avoid disruption?

Run a full unauthenticated penetration test with aggressive payloads during peak business hours.

Ask the development team to provide a list of known vulnerabilities and test only those.

Perform only static analysis on the source code and skip dynamic testing.

Use a combination of authenticated DAST scanning and targeted manual testing during off-peak hours.

A company is retiring a legacy application that contains sensitive customer data. The application is still installed on several servers, and the data is stored in an encrypted database. The company wants to ensure that the data is not accessible after decommissioning. Which action is most important?

Uninstall the application from the servers but leave the database files in place.

Cryptographically erase the database encryption keys and securely wipe or destroy the storage media.

Change the database administrator password and leave the system running.

Move the database to a backup tape and store it in a secure facility.

Which of the following is a typical automated security check that can be integrated into a CI/CD pipeline?

Physical security inspection of the data center

Manual penetration testing after every release

Static application security testing (SAST) on every code commit

User acceptance testing (UAT) by business stakeholders

GIAC Information Security Professional

Domain 3Objective 3

Software Development Security GISP Practice Questions (Page 8)

Part of the Access, Testing, and Development domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~29–50 in this domain), expect 10–17 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

9concepts

Questions 36–40

36expert · hard
A company is decommissioning a cloud-based application that used a customer-managed encryption key (CMEK) to encrypt data at rest. The data is stored in a cloud storage bucket. The company wants to ensure that the data is irrecoverable after decommissioning. Which action is most effective?
Select an answer first
37expert · hard
A security team is planning a penetration test for a web application that handles sensitive financial data. The application is in production and cannot be taken offline. The team has a limited time window and must minimize the risk of disrupting business operations. Which testing approach best balances thoroughness with the need to avoid disruption?
Select an answer first
38foundation · easy
In the STRIDE threat modeling framework, which threat category is primarily concerned with an attacker pretending to be another user or system to gain unauthorized access?
Select an answer first
39application · medium
A company is retiring a legacy application that contains sensitive customer data. The application is still installed on several servers, and the data is stored in an encrypted database. The company wants to ensure that the data is not accessible after decommissioning. Which action is most important?
Select an answer first
40foundation · easy
Which of the following is a typical automated security check that can be integrated into a CI/CD pipeline?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISP” is a trademark of its owner, used for identification only.

Software Development Security GISP Practice Questions (Page 8)

Questions 36–40

A company is decommissioning a cloud-based application that used a customer-managed encryption key (CMEK) to encrypt data at rest. The data is stored in a cloud storage bucket. The company wants to ensure that the data is irrecoverable after decommissioning. Which action is most effective?

In the STRIDE threat modeling framework, which threat category is primarily concerned with an attacker pretending to be another user or system to gain unauthorized access?

Which of the following is a typical automated security check that can be integrated into a CI/CD pipeline?

Keep studying — Access, Testing, and Development