A multi-national company is adopting a cloud-first strategy. They need to demonstrate compliance with a framework that is recognized internationally and also provides a certification process. They are considering ISO/IEC 27001 and NIST CSF. Which statement BEST describes the difference?

Both are certifiable and internationally recognized.

ISO 27001 is certifiable, while NIST CSF is a voluntary framework without a certification process.

NIST CSF is certifiable, while ISO 27001 is voluntary.

Both are voluntary and not certifiable.

An organization is using the CIS Critical Security Controls to assess their cloud environment. They want to implement a control that helps detect unauthorized access attempts. Which CIS control area should they focus on?

Continuous Vulnerability Management

Security Awareness and Skills Training

A security architect is designing a cloud environment that must meet both CIS Controls and CSA CCM requirements. They need to implement a control that satisfies both frameworks' requirements for access control. Which control implementation would satisfy both?

Use network segmentation to limit access

Enable multi-factor authentication (MFA) for all users

Implement a single sign-on (SSO) solution

Implement role-based access control (RBAC) with least privilege and regular access reviews

A company is using a container orchestration platform (e.g., Kubernetes) on top of IaaS. They are using the CIS Critical Security Controls to assess their responsibilities. Which control is MOST likely to be the customer's responsibility?

Patching the underlying physical servers

Securing the network infrastructure

Securing the container images and their configurations

GIAC Cloud Security Essentials

Domain 1Objective 3

Frameworks for Built-In Security GCLD Practice Questions (Page 2)

Part of the Cloud Fundamentals and Shared Responsibility domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–19 in this domain), expect 3–5 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

3concepts

Questions 6–10

6expert · hard
A multi-national company is adopting a cloud-first strategy. They need to demonstrate compliance with a framework that is recognized internationally and also provides a certification process. They are considering ISO/IEC 27001 and NIST CSF. Which statement BEST describes the difference?
Select an answer first
7application · medium
An organization is using the CIS Critical Security Controls to assess their cloud environment. They want to implement a control that helps detect unauthorized access attempts. Which CIS control area should they focus on?
Select an answer first
8expert · hard
A security architect is designing a cloud environment that must meet both CIS Controls and CSA CCM requirements. They need to implement a control that satisfies both frameworks' requirements for access control. Which control implementation would satisfy both?
Select an answer first
9foundation · easy
A cloud security analyst is asked to recommend a framework that provides a structured set of security controls and best practices specifically for cloud computing environments, including guidance on cloud-specific risks such as misconfiguration and identity management. Which framework is most directly designed for this purpose?
Select an answer first
10expert · hard
A company is using a container orchestration platform (e.g., Kubernetes) on top of IaaS. They are using the CIS Critical Security Controls to assess their responsibilities. Which control is MOST likely to be the customer's responsibility?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCLD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCLD” is a trademark of its owner, used for identification only.