Download GIAC Cloud Security Automation Ultimate Exam and more Exams Technology in PDF only on Docsity!
Ultimate Exam
Question 1. Which of the following best describes the “Shift‑Left” concept in cloud security automation? A) Deploying security controls after production release B) Integrating security testing early in the development lifecycle C) Moving workloads to on‑premises data centers D) Outsourcing security to third‑party vendors Answer: B Explanation: “Shift‑Left” means embedding security checks (e.g., SAST, IaC scans) at the earliest stages—code commit, build, and test—so vulnerabilities are discovered before they reach production. Question 2. In the “Three Ways” of DevOps, the first way focuses on: A) Amplifying feedback loops B) Optimizing the flow of work from development to operations C) Fostering a culture of continuous learning D) Automating incident response Answer: B Explanation: The first way emphasizes smooth, fast flow of value from development through operations, reducing hand‑off delays and bottlenecks. Question 3. Which AWS service provides a native, fully managed IaC solution? A) AWS Config B) AWS CloudFormation C) AWS Secrets Manager D) AWS GuardDuty Answer: B Explanation: AWS CloudFormation lets you define and provision AWS resources using declarative templates, enabling automated, repeatable infrastructure deployment.
Ultimate Exam
Question 4. When using Terraform, which command validates the syntax and internal consistency of configuration files without contacting any provider? A) terraform plan B) terraform validate C) terraform fmt D) terraform apply Answer: B Explanation: terraform validate checks the configuration locally for syntax errors and internal consistency; it does not query provider APIs. Question 5. An organization wants to prevent configuration drift in its cloud environment. Which practice is most effective? A) Manual review of resources every month B) Storing configurations in a version‑controlled repository and applying them via CI pipelines C) Using default security groups only D) Relying on ad‑hoc scripts run by administrators Answer: B Explanation: Version‑controlled IaC applied through automated pipelines ensures the live environment matches the declared state, eliminating drift. Question 6. Which of the following is a primary benefit of using configuration management tools like Ansible for cloud resources? A) Automatic cost optimization of instances B) Enforcing a desired state across multiple servers consistently C) Providing server‑less compute capabilities D) Generating SSL certificates automatically Answer: B Explanation: Ansible applies idempotent playbooks to enforce a defined configuration, ensuring all managed nodes stay in the desired state.
Ultimate Exam
Question 10. Which deployment strategy reduces risk by routing a small percentage of traffic to a new version before full rollout? A) Blue/Green B) Canary C) Rolling update without traffic split D) Immediate cut‑over Answer: B Explanation: Canary deployments expose only a subset of users to the new version, allowing issues to be detected before scaling. Question 11. An artifact signing process in a CI/CD pipeline primarily provides which security guarantee? A) Confidentiality of source code B) Integrity and authenticity of build outputs C) Automatic vulnerability remediation D) Encryption of network traffic Answer: B Explanation: Digital signatures ensure that an artifact has not been altered and originates from a trusted build environment. Question 12. Which Kubernetes component stores the desired state of the cluster and validates all changes? A) kube‑proxy B) kube‑scheduler C) etcd D) kube‑let Answer: C
Ultimate Exam
Explanation: etcd is the distributed key‑value store that holds the cluster’s configuration, including RBAC policies and resource definitions. Question 13. In Kubernetes RBAC, which resource grants permissions to perform actions on a set of API resources? A) RoleBinding B) ServiceAccount C) ClusterRole D) ConfigMap Answer: C Explanation: A ClusterRole defines a set of permissions (verbs on resources) that can be bound cluster‑wide or to a namespace. Question 14. Which of the following Kubernetes objects is used to enforce network traffic rules between pods? A) PersistentVolumeClaim B) NetworkPolicy C) HorizontalPodAutoscaler D) Ingress Answer: B Explanation: NetworkPolicy objects define how pods are allowed to communicate with each other and with external endpoints. Question 15. OPA (Open Policy Agent) integrated as an admission controller is primarily used to: A) Scale pods automatically based on CPU usage B) Enforce custom policy decisions on resource creation requests C) Provide secret management for containers D) Perform load balancing across services
Ultimate Exam
Explanation: HashiCorp Vault can generate dynamic secrets (e.g., database credentials) that automatically expire after a configurable TTL. Question 19. In AWS, which feature enables an EC2 instance to obtain temporary credentials without storing long‑term keys? A) IAM user access keys B) Instance Metadata Service (IMDS) v2 with IAM role attached C) AWS Secrets Manager static secret D) S3 bucket policy Answer: B Explanation: Attaching an IAM role to an EC2 instance lets the instance retrieve short‑lived credentials via IMDSv2, eliminating static secrets. Question 20. Which method best automates TLS certificate renewal for public‑facing services? A) Manually uploading new certificates every year B) Using Let’s Encrypt with automated ACME client (e.g., Cert‑Manager) C) Disabling TLS and using HTTP only D) Relying on self‑signed certificates without rotation Answer: B Explanation: Cert‑Manager automates the issuance and renewal of Let’s Encrypt certificates via the ACME protocol. Question 21. A “Policy as Code” (PaC) tool that integrates with Terraform to enforce organizational guardrails is: A) Cloud Custodian B) Sentinel (HashiCorp) C) AWS Config Rules D) Azure Policy Answer: B
Ultimate Exam
Explanation: Sentinel is HashiCorp’s policy‑as‑code framework that can evaluate Terraform plans before they are applied. Question 22. Which compliance framework focuses on a set of 20 critical security controls for cloud environments? A) PCI DSS B) CIS Benchmarks C) HIPAA D) ISO 27001 Answer: B Explanation: The Center for Internet Security (CIS) provides benchmarks and the CIS Controls, a concise set of security best practices for cloud workloads. Question 23. Continuous compliance monitoring in AWS can be automated using which service? A) AWS Lambda B) AWS Config C) Amazon SQS D) AWS CloudTrail Answer: B Explanation: AWS Config continuously records resource configurations and evaluates them against rule sets, providing real‑time compliance data. Question 24. Which of the following is an example of a “self‑healing” workflow in cloud security? A) Manual patching of a vulnerable EC2 instance B) An automated Lambda function that re‑creates a misconfigured S3 bucket with proper encryption C) Sending an email alert when a security group is open to the world D) Logging all API calls to CloudTrail
Ultimate Exam
Answer: B Explanation: Serverless functions (e.g., Lambda) are short‑lived and do not allow installing persistent monitoring agents, requiring native or log‑based observability. Question 28. In a SOAR platform, which action would most likely be automated when a compromised EC2 instance is identified? A) Sending a manual ticket to the security team B) Immediately revoking the instance’s IAM role and isolating the instance in a quarantine security group C) Rebooting the instance without investigation D) Deleting all IAM users in the account Answer: B Explanation: SOAR playbooks can automatically isolate compromised assets, revoke credentials, and place them in a quarantine network segment. Question 29. Which of the following is a recommended practice when storing Terraform state files in a remote backend? A) Keep the state file in a public GitHub repository B) Enable server‑side encryption and versioning on the storage bucket C) Store the state in plain text on a local workstation D) Disable state locking to improve speed Answer: B Explanation: Remote backends (e.g., S3) should have encryption and versioning enabled to protect the state, which contains sensitive data, and use locking to prevent concurrent writes. Question 30. What is the primary purpose of a “git secret scan” pre‑merge hook? A) To enforce code style guidelines B) To detect and block commits containing hard‑coded credentials before they are merged C) To automatically merge pull requests after 24 hours
Ultimate Exam
D) To generate documentation from code comments Answer: B Explanation: Pre‑merge hooks can run secret‑scanning tools that reject merges introducing exposed secrets. Question 31. Which Kubernetes admission controller can automatically inject a sidecar container for runtime security monitoring? A) NamespaceLifecycle B) MutatingAdmissionWebhook (e.g., with Istio sidecar injector) C) ValidatingAdmissionWebhook only D) NodeRestriction Answer: B Explanation: A MutatingAdmissionWebhook can modify pod specs on creation, such as adding a security sidecar. Question 32. In Azure, which service provides a unified view of security posture and can trigger automated remediation via Azure Logic Apps? A) Azure Monitor B) Azure Sentinel (Microsoft Sentinel) C) Azure Advisor D) Azure DevOps Answer: B Explanation: Microsoft Sentinel aggregates security findings and can execute playbooks (Logic Apps) for automated response. Question 33. Which of the following best characterizes “dynamic secrets” in a vault system? A) Secrets that never expire and are stored permanently B) Secrets generated on demand with a limited TTL, reducing exposure risk C) Static API keys checked into source control
Ultimate Exam
D) Use only host‑based firewalls Answer: B Explanation: Zero Trust assumes no implicit trust; policies must explicitly allow required traffic, defaulting to deny. Question 37. Which AWS native service can be used to enforce tagging compliance on resources as they are created? A) AWS Organizations B) AWS Config with a managed rule (e.g., required-tags) C) Amazon CloudWatch D) AWS IAM Access Analyzer Answer: B Explanation: AWS Config rules can evaluate resources for required tags and trigger remediation if missing. Question 38. In a CI pipeline, which stage is the most appropriate place to run a dependency‑check SCA scan? A) After deployment to production B) During the build step, before artifact packaging C) During the initial commit to version control D) Only when a security incident occurs Answer: B Explanation: Running SCA during the build ensures vulnerable dependencies are caught before artifacts are produced. Question 39. Which Kubernetes feature provides a per‑pod identity that can be used to fetch short‑lived tokens from the cloud provider? A) ServiceAccount token projection (TokenRequest API) B) PersistentVolumeClaim
Ultimate Exam
C) ConfigMap D) HorizontalPodAutoscaler Answer: A Explanation: The TokenRequest API allows a pod to request a JWT that is short‑lived and scoped to its ServiceAccount, enabling workload identity. Question 40. What is the main advantage of using a “canary” deployment combined with automated health checks? A) It eliminates the need for load balancers B) It enables immediate rollback if health checks fail on the new version C) It reduces the number of required instances by half D) It permanently deletes the old version after deployment Answer: B Explanation: Automated health checks monitor the canary; failures trigger an automated rollback, minimizing impact. Question 41. Which of the following best describes the purpose of a “guardrail” in cloud security automation? A) A physical barrier protecting data centers B) An automated policy that prevents prohibited configurations before they are applied C) A manual checklist used during audits D) An encryption algorithm for data at rest Answer: B Explanation: Guardrails are automated controls (e.g., Sentinel policies) that enforce compliance and prevent risky configurations. Question 42. In the context of cloud-native observability, which component is responsible for scraping metrics from Kubernetes nodes and pods? A) Grafana
Ultimate Exam
B) Use parameterized modules that accept region as an input variable C) Write separate scripts for each region without version control D) Manually edit resources after deployment Answer: B Explanation: Parameterized modules allow the same code to be reused across regions, improving maintainability. Question 46. Which tool can be used to enforce policy compliance on Terraform plans before they are applied, and integrates with Terraform Cloud? A) Conftest B) Sentinel C) Cloud Custodian D) Chef InSpec Answer: B Explanation: Sentinel is built into Terraform Cloud/Enterprise and evaluates policies against plans. Question 47. Which of the following is a primary advantage of using a “service mesh” like Istio for security? A) It replaces the need for container orchestration B) It provides mutual TLS (mTLS) for pod‑to‑pod communication automatically C) It stores secrets in plain text for easy access D) It eliminates the need for any network policies Answer: B Explanation: Service meshes can enforce mTLS, providing encryption and identity verification for intra‑cluster traffic. Question 48. In the context of CI/CD, what does “artifact promotion” refer to? A) Deleting old build artifacts after a week B) Moving a vetted artifact from a staging repository to production after passing tests
Ultimate Exam
C
Question 49. Which AWS feature can be used to enforce MFA when accessing the console for privileged IAM users? A) IAM password policy B) IAM role assumption with condition aws:MultiFactorAuthPresent C) S3 bucket versioning D) CloudWatch Alarms Answer: B Explanation: Adding a condition that requires aws:MultiFactorAuthPresent forces MFA for console access. Question 50. Which open‑source tool can automatically remediate non‑compliant AWS resources based on Cloud Custodian policies? A) AWS Lambda B) Cloud Custodian itself (via c7n remediate mode) C) AWS Glue D) Terraform Cloud Answer: B Explanation: Cloud Custodian can run in remediation mode to apply corrective actions for resources that violate policies. Question 51. When using GitHub Actions for CI, which of the following helps protect secrets from being exposed in logs? A) Storing secrets in plain text in the workflow file B) Using the secrets context and enabling mask for output values C) Printing all environment variables in the job logs D) Using set - x to debug scripts Answer: B
Ultimate Exam
Answer: B Explanation: Immutable infrastructure avoids in‑place changes; instead, new instances are provisioned and swapped in. Question 55. Which of the following is a primary benefit of using “GitOps” for cloud security automation? A) Manual approval of every change B) Storing operational intent as declarative code in Git, enabling automated reconciliation and auditability C) Eliminating the need for CI pipelines D) Allowing any developer to push directly to production without review Answer: B Explanation: GitOps treats Git as the source of truth; automated agents ensure the live environment matches the declared state, providing traceability. Question 56. Which AWS service can automatically detect and remediate publicly accessible S buckets? A) AWS Shield B) Amazon Macie (in combination with AWS Config) C) AWS CloudWatch Logs D) Amazon Aurora Answer: B Explanation: Amazon Macie can discover publicly accessible S3 buckets, and AWS Config rules can trigger remediation. Question 57. Which of the following is a recommended practice when using Kubernetes Secrets for storing database passwords? A) Store the secret in plaintext in the manifest file B) Enable EncryptionConfiguration in the API server to encrypt secrets at rest C) Disable RBAC to simplify access
Ultimate Exam
D) Use kubectl apply without version control Answer: B Explanation: Enabling encryption at rest for Secrets protects them from being read directly from etcd. Question 58. What is the primary purpose of a “service catalog” in a cloud environment? A) To provide a list of available compute instance types only B) To enable self‑service provisioning of vetted, pre‑approved resources while enforcing policies C) To store application source code D) To replace the need for IAM Answer: B Explanation: Service catalogs expose approved resource templates, allowing users to provision while maintaining governance. Question 59. Which of the following techniques helps mitigate “dependency confusion” attacks in CI pipelines? A) Allowing any version of a package from any source B) Pinning dependencies to exact versions from trusted internal repositories C) Disabling all package managers D) Using only the latest version of every library Answer: B Explanation: Pinning to exact, vetted versions from internal registries prevents malicious packages from being fetched from public namespaces. Question 60. In Google Cloud, which service provides automated detection of anomalous API activity and can trigger Cloud Functions for response? A) Cloud DNS B) Cloud Armor C) Cloud Security Command Center (SCC) with Event Threat Detection
