A DevOps team is building a CI/CD pipeline for a containerized microservices application. The security manager wants to integrate security testing into the pipeline without slowing down deployments. Which approach best balances security and speed?

Deploy to production and run DAST after release

Perform a full manual penetration test before every release

Run SAST and container image scanning as parallel stages in the pipeline

Only scan container images after deployment to production

What is the purpose of incorporating defense in depth into application design?

To ensure that all security controls are automated

To reduce the number of security controls needed in the application

To make the application easier to use by simplifying security

To ensure that a single security control failure does not compromise the application

What is the primary purpose of application security within an organization's overall security management program?

To ensure that applications comply with all relevant laws and regulations

To focus solely on network perimeter defenses to protect applications from external attacks

To protect applications from threats throughout their lifecycle by identifying, mitigating, and managing risks

To ensure that applications are free from all possible vulnerabilities before deployment

A security manager wants to measure the effectiveness of the application security program and report to executives. The executives are interested in understanding the return on investment and whether the program is reducing risk. Which metric would be most meaningful for this audience?

Percentage of critical vulnerabilities remediated within the agreed SLA

Total hours spent on security training

Number of security incidents in the last year

Number of security tools deployed in the CI/CD pipeline

A security manager discovers that a widely used open source library has a critical vulnerability. The library is used in multiple applications, but the vendor has not yet released a patch. The security manager needs to decide how to respond. Which action is most appropriate?

Remove the library from all applications immediately

Apply interim mitigations such as input validation or WAF rules while monitoring for a vendor patch

Ignore the vulnerability until the vendor releases a patch

Replace the library with a different one without testing

GIAC Security Leadership

Domain 2Objective 4

Managing Application Security GSLC Practice Questions (Page 8)

Part of the Technical Security Management domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~19–32 in this domain), expect 4–6 from this objective — we provide 63 practice questions to prepare you well beyond it. (estimate)

63questions here

13free pages

15concepts

15 Concepts in This Objective

Application Security Fundamentals
Secure Software Development Lifecycle (SSDLC)
Threat Modeling
Common Application Vulnerabilities
Application Security Testing
Security Requirements and Design
Secure Coding Practices
Application Security Controls
Application Security Governance
Vulnerability Management for Applications
Application Security Metrics and Reporting
Application Security in DevOps and Cloud
Third-Party and Open Source Component Security
Incident Response for Application Security
Application Security Awareness and Training

Questions 36–40

36application · medium
A DevOps team is building a CI/CD pipeline for a containerized microservices application. The security manager wants to integrate security testing into the pipeline without slowing down deployments. Which approach best balances security and speed?
Select an answer first
37foundation · easy
What is the purpose of incorporating defense in depth into application design?
Select an answer first
38foundation · easy
What is the primary purpose of application security within an organization's overall security management program?
Select an answer first
39expert · hard
A security manager wants to measure the effectiveness of the application security program and report to executives. The executives are interested in understanding the return on investment and whether the program is reducing risk. Which metric would be most meaningful for this audience?
Select an answer first
40expert · hard
A security manager discovers that a widely used open source library has a critical vulnerability. The library is used in multiple applications, but the vendor has not yet released a patch. The security manager needs to decide how to respond. Which action is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.