What is a common tool or technique used to manage risks from open source components?

Software Composition Analysis (SCA)

Static Application Security Testing (SAST)

A company is adopting infrastructure as code (IaC) to manage its cloud environment. The security manager wants to ensure that security is integrated into the IaC pipeline. Which practice is most effective?

Disable IaC and use manual configuration to have more control

Manually review IaC templates after deployment

Only use IaC for non-production environments

Scan IaC templates for misconfigurations before deployment and enforce policy as code

A DevOps team deploys containerized microservices to a cloud platform. The security manager wants to ensure that security checks are integrated into the continuous integration/continuous deployment (CI/CD) pipeline. Which action best achieves this?

Require developers to run a vulnerability scanner on their local machines before committing.

Deploy a web application firewall (WAF) in front of the production environment.

Conduct a manual security review of the codebase after each major release.

Add a pipeline stage that runs SAST on source code and container image scanning before deployment.

Why is it important to verify that a vulnerability has been remediated?

To assign a CVSS score to the vulnerability

To identify new vulnerabilities introduced by the fix

To document the vulnerability in the risk register

To ensure that the fix is effective and the vulnerability is no longer exploitable

GIAC Security Leadership

Domain 2Objective 4

Managing Application Security GSLC Practice Questions (Page 1)

Part of the Technical Security Management domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~19–32 in this domain), expect 4–6 from this objective — we provide 63 practice questions to prepare you well beyond it. (estimate)

63questions here

13free pages

15concepts

15 Concepts in This Objective

Application Security Fundamentals
Secure Software Development Lifecycle (SSDLC)
Threat Modeling
Common Application Vulnerabilities
Application Security Testing
Security Requirements and Design
Secure Coding Practices
Application Security Controls
Application Security Governance
Vulnerability Management for Applications
Application Security Metrics and Reporting
Application Security in DevOps and Cloud
Third-Party and Open Source Component Security
Incident Response for Application Security
Application Security Awareness and Training

Questions 1–5

1foundation · easy
What is a common tool or technique used to manage risks from open source components?
Select an answer first
2expert · hard
A company is adopting infrastructure as code (IaC) to manage its cloud environment. The security manager wants to ensure that security is integrated into the IaC pipeline. Which practice is most effective?
Select an answer first
3foundation · easy
Which security design principle ensures that a user or process is granted only the minimum permissions necessary to perform its function?
Select an answer first
4application · medium
A DevOps team deploys containerized microservices to a cloud platform. The security manager wants to ensure that security checks are integrated into the continuous integration/continuous deployment (CI/CD) pipeline. Which action best achieves this?
Select an answer first
5foundation · easy
Why is it important to verify that a vulnerability has been remediated?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.