Which security benefit is most directly achieved by implementing micro-segmentation?

Preventing all external attacks

Eliminating the need for network monitoring

Guaranteeing compliance with all regulatory frameworks

Containing a breach by restricting east-west traffic between workloads

A security team is planning to implement micro-segmentation in a cloud environment with many legacy applications that have undocumented dependencies. The team wants to avoid breaking these applications. What is the first step they should take?

Enable flow logging and analyze traffic patterns between workloads for a period of time.

Disable all existing firewall rules to start from a clean slate.

Create policies based on the application architecture diagrams provided by the development team.

Implement policies in enforcement mode immediately to ensure security.

A security architect is evaluating distributed firewall solutions for a large cloud deployment with thousands of workloads. The primary requirement is to enforce consistent security policies across all workloads, including those that are ephemeral. Which feature is most important to look for in a distributed firewall?

Integration with the cloud provider's native security groups.

Centralized logging of all firewall events to a SIEM.

Support for both IPv4 and IPv6 addresses.

Policy enforcement based on workload attributes such as tags or labels, rather than IP addresses.

A company has implemented micro-segmentation using security groups. They want to ensure that any change to a security group is reviewed and does not violate the principle of least-privilege. Which process is most effective?

Disable all security group changes after initial deployment.

Allow administrators to change security groups directly in the console and review changes monthly.

Use a script that automatically opens any port that is requested by a developer.

Use infrastructure-as-code to manage security groups and require peer review for any change.

When designing security groups for a multi-tier application, what is the best practice to enforce least-privilege access?

Place all workloads in the same subnet and rely on network ACLs only

Create separate security groups for each tier and allow only required ports and protocols

Use the same security group for all tiers to reduce complexity

Allow all traffic between tiers to simplify management

GIAC Cloud Security Architecture and Design

Domain 2Objective 2

Cloud Network Micro Segmentation GCAD Practice Questions (Page 6)

Part of the Network Architecture and Security domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–19 in this domain), expect 3–5 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

8concepts

Questions 26–30

26foundation · easy
Which security benefit is most directly achieved by implementing micro-segmentation?
Select an answer first
27application · medium
A security team is planning to implement micro-segmentation in a cloud environment with many legacy applications that have undocumented dependencies. The team wants to avoid breaking these applications. What is the first step they should take?
Select an answer first
28application · medium
A security architect is evaluating distributed firewall solutions for a large cloud deployment with thousands of workloads. The primary requirement is to enforce consistent security policies across all workloads, including those that are ephemeral. Which feature is most important to look for in a distributed firewall?
Select an answer first
29application · medium
A company has implemented micro-segmentation using security groups. They want to ensure that any change to a security group is reviewed and does not violate the principle of least-privilege. Which process is most effective?
Select an answer first
30foundation · easy
When designing security groups for a multi-tier application, what is the best practice to enforce least-privilege access?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCAD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCAD” is a trademark of its owner, used for identification only.