Managing Application Security GSLC Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A developer is writing a function that constructs a SQL query using user input. Which coding practice is most effective in preventing SQL injection?

   • AEscape single quotes in the user input before building the query.
   • BValidate that the input contains only alphanumeric characters.
   • CUse parameterized queries or prepared statements.
   • DUse a stored procedure that concatenates the input into a dynamic SQL string.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security incident has been detected in a web application. The attack appears to exploit a cross-site scripting vulnerability. The security team needs to respond while preserving evidence for a potential legal case. Which action should be taken first?

   • AShut down the server and disconnect it from the network
   • BTake a forensic image of the affected server and preserve logs
   • CNotify the public about the breach
   • DImmediately patch the XSS vulnerability in the source code
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the first priority when responding to an application security incident?

   • AContaining the incident to prevent further damage
   • BRestoring the application to normal operation
   • CIdentifying the root cause
   • DNotifying law enforcement
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security team has identified a critical vulnerability in a custom application. The vulnerability is complex to exploit but could lead to a data breach. The team has limited resources and must decide how to prioritize remediation. Which factor should be the primary consideration?

   • AThe number of lines of code affected by the vulnerability.
   • BThe likelihood of exploitation and the potential business impact.
   • CThe age of the application code.
   • DThe developer's familiarity with the codebase.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company has experienced several security incidents caused by developers using insecure coding practices. The security manager wants to reduce these incidents. Which approach is most likely to be effective?

   • ARequire all developers to pass a one-time security exam
   • BDisable all code review processes to speed up development
   • CProvide role-based secure coding training and integrate security reviews into the development process
   • DFire developers who make security mistakes
   Reveal Solution Discussion Select an answer first