Managing Application Security GSLC Practice Questions (Page 12)

Questions 56–60

1. 56application · medium

   A team is designing a new internal HR application that will store employee records. The security manager wants to ensure that employees can only view their own records, while HR staff can view all records. Which security design principle should be applied?

   • AApply defense in depth by adding multiple layers of firewalls.
   • BEncrypt all data at rest and in transit.
   • CUse a single shared account for all employees to simplify management.
   • DImplement role-based access control (RBAC) with least privilege.
   Reveal Solution Discussion Select an answer first
2. 57foundation · easy

   What is the purpose of the recovery phase in application incident response?

   • ATo collect forensic evidence
   • BTo update the incident response plan
   • CTo identify the attacker's identity
   • DTo restore the application to a known good state and resume normal operations
   Reveal Solution Discussion Select an answer first
4. 58application · medium

   A company's developers frequently introduce security flaws because they are unaware of secure coding practices. The security manager wants to reduce these flaws over the long term. Which initiative is most effective?

   • APublish a security policy that requires all code to be reviewed by the security team.
   • BOutsource all development to a third-party firm that specializes in secure coding.
   • CPurchase an automated code analysis tool and run it only before release.
   • DImplement a role-based secure coding training program with practical exercises and periodic refreshers.
   Reveal Solution Discussion Select an answer first
5. 59foundation · easy

   What is the primary purpose of application security governance?

   • ATo perform penetration testing on all applications
   • BTo purchase and deploy security tools
   • CTo monitor application performance in production
   • DTo establish policies, standards, and processes that guide secure application development
   Reveal Solution Discussion Select an answer first
6. 60foundation · easy

   Why is it important to provide application security training to developers?

   • ATo guarantee that no vulnerabilities will be introduced
   • BTo ensure developers understand how to write secure code and avoid common vulnerabilities
   • CTo make developers responsible for all security incidents
   • DTo replace the need for security testing tools
   Reveal Solution Discussion Select an answer first