Managing Application Security GSLC Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   In a DevOps pipeline, at which stage should security testing be integrated to be most effective?

   • AOnly at the end before production release
   • BContinuously throughout the pipeline from code commit to deployment
   • COnly after deployment to production
   • DOnly during the design phase
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security architect is leading a threat modeling exercise for a new online payment system. The system will handle credit card data and must comply with PCI DSS. The team has identified several threats, but they have limited time to address all of them. Which approach should the architect use to prioritize the threats?

   • ARank threats based on the likelihood of exploitation and the potential impact on cardholder data
   • BAddress threats in the order they were identified during the session
   • CIgnore threats that require complex mitigations
   • DFocus only on threats that are easy to mitigate
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is an example of an application security governance activity?

   • AConfiguring a web application firewall
   • BDefining a secure coding standard that all developers must follow
   • CRunning a vulnerability scanner against a web application
   • DPatching a critical vulnerability in a production application
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security architect is designing a public-facing web application that will accept file uploads from users. The application will store these files and serve them back to other users. Which set of controls is most effective in preventing malicious file uploads from compromising the server?

   • AAllow any file type but scan all files with antivirus software
   • BOnly allow image files and rename them with a random extension
   • CValidate file type and size on the server, store files outside the web root, and serve them with a content-disposition header
   • DStore files in the web root and rely on the web server to handle them safely
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   An application was breached through a vulnerability in a third-party component. The incident response team has contained the breach and restored service. The security manager must decide how to prevent similar incidents in the future. Which action is most effective?

   • AUpdate the component to a patched version and add automated dependency scanning to the CI/CD pipeline.
   • BDisable the application until a full security audit is completed.
   • CReplace the third-party component with a custom-built module.
   • DIncrease monitoring and logging to detect similar attacks.
   Reveal Solution Discussion Select an answer first