Managing Application Security GSLC Practice Questions (Page 13)

Questions 61–63

1. 61expert · hard

   A security manager needs to report to executives on the effectiveness of the application security program. The executives want to understand whether the program is improving over time. Which set of metrics would provide the most balanced view?

   • ANumber of security tools purchased and total cost of the security program.
   • BNumber of security incidents reported by users and number of support tickets.
   • CTrend of critical vulnerabilities found in production, average time to remediate, and percentage of applications covered by security testing.
   • DTotal lines of code and number of developers trained.
   Reveal Solution Discussion Select an answer first
2. 62foundation · easy

   In a Secure Software Development Lifecycle (SSDLC), which activity is typically performed during the requirements phase to integrate security?

   • AConducting a post-implementation security review
   • BDefining security requirements alongside functional requirements
   • CDeploying the application to production
   • DExecuting penetration tests against the final build
   Reveal Solution Discussion Select an answer first
3. 63foundation · easy

   When is Dynamic Application Security Testing (DAST) most appropriately applied?

   • AAgainst a running application to identify runtime vulnerabilities
   • BAfter a security incident to analyze logs
   • CDuring requirements gathering to define security controls
   • DDuring the coding phase to identify syntax errors
   Reveal Solution Discussion Select an answer first