Which type of application security testing analyzes source code without executing the application?

Interactive Application Security Testing (IAST)

Dynamic Application Security Testing (DAST)

Static Application Security Testing (SAST)

What is the primary goal of threat modeling for an application?

To eliminate all possible attack vectors from the application

To ensure the application meets all regulatory compliance requirements

To identify and prioritize potential threats to the application

To test the application after deployment for vulnerabilities

What is the primary purpose of output encoding as an application security control?

To prevent injection attacks by neutralizing dangerous characters in data before it is displayed

To validate that user input meets business rules

To restrict which users can access certain functions

To encrypt data stored in the database

A security team has a backlog of 500 application vulnerabilities. The team has limited staff and must prioritize remediation. The organization is subject to a compliance requirement that mandates fixing all critical vulnerabilities within 30 days. Which prioritization approach best balances compliance and risk?

Delay all remediation until the compliance audit is announced.

Prioritize by risk score, but ensure all critical vulnerabilities are scheduled within the compliance deadline.

Fix vulnerabilities in the order they were discovered.

Focus only on vulnerabilities that are easy to fix to reduce the backlog quickly.

A software company uses several open-source libraries in its flagship product. The security team wants to ensure that known vulnerabilities in these components are identified and managed on an ongoing basis. Which practice should be implemented?

Perform a one-time security assessment of all libraries before the next release.

Require developers to manually review all open-source code before use.

Maintain a software bill of materials (SBOM) and run automated vulnerability scanning on dependencies.

Prohibit the use of all open-source components in production.

GIAC Security Leadership

Domain 2Objective 4

Managing Application Security GSLC Practice Questions (Page 6)

Part of the Technical Security Management domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~19–32 in this domain), expect 4–6 from this objective — we provide 63 practice questions to prepare you well beyond it. (estimate)

63questions here

13free pages

15concepts

15 Concepts in This Objective

Application Security Fundamentals
Secure Software Development Lifecycle (SSDLC)
Threat Modeling
Common Application Vulnerabilities
Application Security Testing
Security Requirements and Design
Secure Coding Practices
Application Security Controls
Application Security Governance
Vulnerability Management for Applications
Application Security Metrics and Reporting
Application Security in DevOps and Cloud
Third-Party and Open Source Component Security
Incident Response for Application Security
Application Security Awareness and Training

Questions 26–30

26foundation · easy
Which type of application security testing analyzes source code without executing the application?
Select an answer first
27foundation · easy
What is the primary goal of threat modeling for an application?
Select an answer first
28foundation · easy
What is the primary purpose of output encoding as an application security control?
Select an answer first
29expert · hard
A security team has a backlog of 500 application vulnerabilities. The team has limited staff and must prioritize remediation. The organization is subject to a compliance requirement that mandates fixing all critical vulnerabilities within 30 days. Which prioritization approach best balances compliance and risk?
Select an answer first
30application · medium
A software company uses several open-source libraries in its flagship product. The security team wants to ensure that known vulnerabilities in these components are identified and managed on an ongoing basis. Which practice should be implemented?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.