Managing Application Security GSLC Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   Why is it important to assess the security of third-party and open source components used in applications?

   • ABecause open source components are always less secure than commercial ones
   • BBecause these components can introduce vulnerabilities that are outside the organization's direct control
   • CBecause third-party components are always free of vulnerabilities
   • DBecause using third-party components eliminates the need for security testing
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   Which structured threat modeling methodology uses a diagram of data flows, trust boundaries, and threat categories such as STRIDE?

   • ACVSS
   • BSAST
   • COWASP ASVS
   • DMicrosoft Threat Modeling Tool
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A large organization has multiple development teams using different security practices. The security manager wants to standardize application security across the organization. Which action is most effective?

   • AEstablish and enforce an application security policy with mandatory standards and processes.
   • BPurchase a single security tool and require all teams to use it.
   • CAllow each team to define its own security practices to encourage innovation.
   • DHire a security consultant to review each application after release.
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   Which of the following best describes how security is integrated into the design phase of a Secure Software Development Lifecycle?

   • ASecurity is addressed by applying patches after deployment
   • BSecurity is limited to using encryption for all data at rest
   • CSecurity is incorporated through threat modeling and secure design principles
   • DSecurity is considered only after the application is fully coded
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   A large organization has multiple development teams using different frameworks and coding standards. The security manager wants to establish consistent application security governance across the organization. Which approach is most effective?

   • ACreate a centralized application security policy with mandatory secure coding standards and conduct regular audits
   • BAllow each team to define its own security standards based on its framework
   • COutsource all application security to a third-party vendor
   • DFocus only on the teams that handle sensitive data
   Reveal Solution Discussion Select an answer first