Which of the following is a secure coding practice to prevent cross-site scripting (XSS)?

Validating input on the server side

Disabling JavaScript in the browser

Using HTTPS for all communications

Encoding output before rendering in the browser

What is a key security consideration when using containers in a cloud environment?

Scanning container images for vulnerabilities before deployment

Disabling all logging to reduce overhead

Using only public container images without review

Ensuring that containers are always run as the root user

A company has a large development team with varying levels of security knowledge. The security manager wants to improve the team's ability to write secure code. Which approach is most effective in the long term?

Hire a security expert to review all code after it is written

Require developers to read the OWASP Top 10 document

Provide a one-time training session on secure coding

Implement a continuous security training program with regular assessments and feedback

A company is migrating a legacy monolithic application to a containerized microservices architecture in the cloud. The security manager must ensure that security testing is integrated into the new CI/CD pipeline. The team uses many open source libraries and wants to avoid slowing down the pipeline. Which approach best addresses these concerns?

Run SAST on source code and container image scanning in parallel, with a software composition analysis (SCA) tool integrated into the build stage

Use only container image scanning and skip source code analysis

Run DAST against the production environment after each deployment

Perform a manual code review of every change before merging

A web application accepts user input in a search field and displays the results on the same page. A security review identified that the application is vulnerable to reflected cross-site scripting (XSS). Which control should be implemented to mitigate this vulnerability?

Disable JavaScript in the user's browser via a response header.

Use a blacklist to block common script tags in user input.

Restrict the search field to a maximum length of 50 characters.

Apply context-aware output encoding on all user-supplied data before rendering.

GIAC Security Leadership

Domain 2Objective 4

Managing Application Security GSLC Practice Questions (Page 9)

Part of the Technical Security Management domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~19–32 in this domain), expect 4–6 from this objective — we provide 63 practice questions to prepare you well beyond it. (estimate)

63questions here

13free pages

15concepts

15 Concepts in This Objective

Application Security Fundamentals
Secure Software Development Lifecycle (SSDLC)
Threat Modeling
Common Application Vulnerabilities
Application Security Testing
Security Requirements and Design
Secure Coding Practices
Application Security Controls
Application Security Governance
Vulnerability Management for Applications
Application Security Metrics and Reporting
Application Security in DevOps and Cloud
Third-Party and Open Source Component Security
Incident Response for Application Security
Application Security Awareness and Training

Questions 41–45

41foundation · easy
Which of the following is a secure coding practice to prevent cross-site scripting (XSS)?
Select an answer first
42foundation · easy
What is a key security consideration when using containers in a cloud environment?
Select an answer first
43expert · hard
A company has a large development team with varying levels of security knowledge. The security manager wants to improve the team's ability to write secure code. Which approach is most effective in the long term?
Select an answer first
44expert · hard
A company is migrating a legacy monolithic application to a containerized microservices architecture in the cloud. The security manager must ensure that security testing is integrated into the new CI/CD pipeline. The team uses many open source libraries and wants to avoid slowing down the pipeline. Which approach best addresses these concerns?
Select an answer first
45application · medium
A web application accepts user input in a search field and displays the results on the same page. A security review identified that the application is vulnerable to reflected cross-site scripting (XSS). Which control should be implemented to mitigate this vulnerability?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.