Managing Application Security GSLC Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which application security control is specifically designed to prevent malicious input from being processed by the application?

   • AOutput encoding
   • BInput validation
   • CLogging and monitoring
   • DAccess controls
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A healthcare startup is building a patient portal that will handle PHI. The security manager is leading the design phase and wants to identify potential threats before any code is written. The team has limited time and needs a structured approach that focuses on data flows and trust boundaries. Which approach best meets this need?

   • ARun a dynamic application security test against a staging instance of the portal
   • BPerform a static code analysis scan on the planned architecture documents
   • CDeploy a web application firewall in front of the portal to block attacks
   • DConduct a threat modeling session using data flow diagrams and STRIDE
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which secure coding practice is most effective at preventing SQL injection vulnerabilities?

   • AUsing parameterized queries or prepared statements
   • BEncoding all output with HTML entities
   • CUsing client-side validation for all inputs
   • DDisabling error messages in production
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A security manager is responsible for testing a web application that has both a JavaScript-heavy frontend and a complex backend API. The team wants to identify vulnerabilities that are only visible when the application is running, such as business logic flaws and authentication bypasses. Which testing approach is most appropriate?

   • ASoftware composition analysis (SCA) to check for vulnerable libraries
   • BInteractive application security testing (IAST) with agents in the application
   • CDynamic application security testing (DAST) against a staging environment
   • DStatic application security testing (SAST) on the frontend and backend code
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   What is the primary purpose of application security metrics?

   • ATo measure the effectiveness of security activities and support decision-making
   • BTo replace the need for security testing
   • CTo automate the remediation of vulnerabilities
   • DTo guarantee that applications are free from vulnerabilities
   Reveal Solution Discussion Select an answer first