A financial services company is developing a customer-facing web application that accepts loan applications. The application allows users to upload documents and submit personal information. The security team wants to prevent injection attacks and cross-site scripting. Which combination of controls should be implemented?

Web application firewall and network segmentation

Input validation on the server side and output encoding on all dynamic content

Client-side JavaScript validation and a content security policy

Parameterized queries and disabling JavaScript in the browser

A company is developing a new internal tool that will handle sensitive customer data. The security manager is defining security requirements during the design phase. Which requirement best reflects the principle of least privilege?

Users can only access the data and functions required for their role

All data must be encrypted at rest and in transit

All users must authenticate with multi-factor authentication

The application must be available 99.99% of the time

Which of the following is an effective way to promote application security awareness among stakeholders?

Keeping security policies confidential to avoid overwhelming stakeholders

Providing training only to new hires

Focusing training only on technical staff

Conducting regular security awareness sessions that include real-world examples

A security team has identified a critical vulnerability in a third-party component used by several applications. The vulnerability is actively being exploited in the wild. The team has limited resources and cannot patch all applications immediately. What should the team do first?

Prioritize patching applications that are internet-facing and handle sensitive data

Disable all applications that use the vulnerable component

Wait for the vendor to release a patch before taking any action

Patch all applications at the same time to ensure consistency

A web application is suspected of being compromised through a SQL injection vulnerability. The security team needs to contain the incident and prevent further damage. Which action should be taken first?

Notify law enforcement immediately

Isolate the affected application server from the network

Delete all logs related to the incident

Patch the SQL injection vulnerability in the source code

GIAC Security Leadership

Domain 2Objective 4

Managing Application Security GSLC Practice Questions (Page 4)

Part of the Technical Security Management domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~19–32 in this domain), expect 4–6 from this objective — we provide 63 practice questions to prepare you well beyond it. (estimate)

63questions here

13free pages

15concepts

15 Concepts in This Objective

Application Security Fundamentals
Secure Software Development Lifecycle (SSDLC)
Threat Modeling
Common Application Vulnerabilities
Application Security Testing
Security Requirements and Design
Secure Coding Practices
Application Security Controls
Application Security Governance
Vulnerability Management for Applications
Application Security Metrics and Reporting
Application Security in DevOps and Cloud
Third-Party and Open Source Component Security
Incident Response for Application Security
Application Security Awareness and Training

Questions 16–20

16application · medium
A financial services company is developing a customer-facing web application that accepts loan applications. The application allows users to upload documents and submit personal information. The security team wants to prevent injection attacks and cross-site scripting. Which combination of controls should be implemented?
Select an answer first
17application · medium
A company is developing a new internal tool that will handle sensitive customer data. The security manager is defining security requirements during the design phase. Which requirement best reflects the principle of least privilege?
Select an answer first
18foundation · easy
Which of the following is an effective way to promote application security awareness among stakeholders?
Select an answer first
19application · medium
A security team has identified a critical vulnerability in a third-party component used by several applications. The vulnerability is actively being exploited in the wild. The team has limited resources and cannot patch all applications immediately. What should the team do first?
Select an answer first
20application · medium
A web application is suspected of being compromised through a SQL injection vulnerability. The security team needs to contain the incident and prevent further damage. Which action should be taken first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.