A DevOps team wants to ensure that every new storage bucket created in their cloud environment is automatically encrypted and tagged with a sensitivity classification. They want to enforce this without requiring developers to remember the steps. Which automation approach is most effective?

Use infrastructure-as-code templates that include encryption and tagging settings, and enforce them through policy checks in the CI/CD pipeline.

Rely on the cloud provider's default settings, assuming all buckets are encrypted and tagged by default.

Provide developers with a checklist of manual steps to follow after creating a bucket.

Create a post-creation script that runs once a week to add encryption and tags to any new buckets.

Which cloud service or feature is commonly used to automate the enforcement of data protection policies across cloud resources?

Infrastructure as Code (IaC) templates that include security configurations

Periodic security audits performed by third parties

Manual configuration of each resource by administrators

Using a single password for all cloud accounts

A security team needs to ensure that only authorized analysts can access a database containing sensitive customer records. They also want to detect any unauthorized access attempts. Which combination of controls should be implemented?

Encrypt the database and assume that encryption prevents unauthorized access.

Apply least-privilege IAM roles to the database and enable audit logging that captures access attempts.

Grant all employees database access and rely on network firewalls to block external threats.

Set up a DLP policy that alerts when data is exported, without restricting access.

What is the principle of least privilege in the context of access controls for sensitive data?

Granting access based on the user's seniority in the organization

Granting all users the same level of access for simplicity

Granting administrators full access to all data at all times

Granting users the minimum level of access necessary to perform their job functions

A company must classify data to meet both GDPR and internal data-handling policies. GDPR requires protection of personal data, while internal policy requires that all data be classified into one of four levels. The company also needs to automate retention based on classification. What is the best way to align these requirements?

Define classification levels that incorporate GDPR data categories (e.g., personal data, special categories) and map each to retention and protection policies.

Classify all data as personal data to ensure GDPR compliance.

Use internal levels only and manually identify GDPR data when needed.

Use GDPR categories as the only classification system, ignoring internal levels.

GIAC Cloud Security Essentials

Domain 5Objective 1

Discovering and Storing Sensitive Data GCLD Practice Questions (Page 2)

Part of the Data Protection and Automation domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 4–6 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

9concepts

Questions 6–10

6application · medium
A DevOps team wants to ensure that every new storage bucket created in their cloud environment is automatically encrypted and tagged with a sensitivity classification. They want to enforce this without requiring developers to remember the steps. Which automation approach is most effective?
Select an answer first
7foundation · easy
Which cloud service or feature is commonly used to automate the enforcement of data protection policies across cloud resources?
Select an answer first
8application · medium
A security team needs to ensure that only authorized analysts can access a database containing sensitive customer records. They also want to detect any unauthorized access attempts. Which combination of controls should be implemented?
Select an answer first
9foundation · easy
What is the principle of least privilege in the context of access controls for sensitive data?
Select an answer first
10expert · hard
A company must classify data to meet both GDPR and internal data-handling policies. GDPR requires protection of personal data, while internal policy requires that all data be classified into one of four levels. The company also needs to automate retention based on classification. What is the best way to align these requirements?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCLD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCLD” is a trademark of its owner, used for identification only.