A company is using a serverless function (FaaS) to process sensitive data. They are using the CSA Cloud Controls Matrix to assess their security responsibilities. The provider manages the runtime and platform, but the customer writes the function code. Which control is MOST likely to be the customer's responsibility?

Secure coding practices for the function

Patching the underlying operating system

An organization is migrating a legacy application to the cloud and must comply with a regulation that requires encryption of data at rest. They plan to use a cloud provider's managed database service. Which control should the organization implement to meet this requirement, considering the shared responsibility model?

Enable the provider's managed encryption feature for the database

Rely on the provider's physical security controls

Encrypt the data in the application before storing it

Use a VPN to connect to the database

A security team is using the CIS Critical Security Controls to evaluate their cloud deployment. They want to implement a control that helps identify and remediate known vulnerabilities in their container images. Which CIS Control is most directly applicable?

Secure Configuration of Enterprise Assets and Software

Continuous Vulnerability Management

In the context of cloud shared responsibility, which security control is typically the responsibility of the cloud customer, even when using a framework like NIST or CIS?

Physical security of data center facilities

Patching the hypervisor that hosts virtual machines

Maintaining the underlying network infrastructure

Configuring identity and access management (IAM) policies for user access

GIAC Cloud Security Essentials

Domain 1Objective 3

Frameworks for Built-In Security GCLD Practice Questions (Page 4)

Part of the Cloud Fundamentals and Shared Responsibility domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–19 in this domain), expect 3–5 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

3concepts

Questions 16–20

16expert · hard
A company is using a serverless function (FaaS) to process sensitive data. They are using the CSA Cloud Controls Matrix to assess their security responsibilities. The provider manages the runtime and platform, but the customer writes the function code. Which control is MOST likely to be the customer's responsibility?
Select an answer first
17application · medium
An organization is migrating a legacy application to the cloud and must comply with a regulation that requires encryption of data at rest. They plan to use a cloud provider's managed database service. Which control should the organization implement to meet this requirement, considering the shared responsibility model?
Select an answer first
18application · medium
A cloud security architect is selecting a framework to guide the continuous monitoring of a multi-cloud environment. The framework should provide a common language for describing security outcomes and support iterative improvement cycles. Which framework is best suited for this purpose?
Select an answer first
19application · medium
A security team is using the CIS Critical Security Controls to evaluate their cloud deployment. They want to implement a control that helps identify and remediate known vulnerabilities in their container images. Which CIS Control is most directly applicable?
Select an answer first
20foundation · easy
In the context of cloud shared responsibility, which security control is typically the responsibility of the cloud customer, even when using a framework like NIST or CIS?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCLD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCLD” is a trademark of its owner, used for identification only.

Frameworks for Built-In Security GCLD Practice Questions (Page 4)

Questions 16–20

A cloud security architect is selecting a framework to guide the continuous monitoring of a multi-cloud environment. The framework should provide a common language for describing security outcomes and support iterative improvement cycles. Which framework is best suited for this purpose?

A security team is using the CIS Critical Security Controls to evaluate their cloud deployment. They want to implement a control that helps identify and remediate known vulnerabilities in their container images. Which CIS Control is most directly applicable?

In the context of cloud shared responsibility, which security control is typically the responsibility of the cloud customer, even when using a framework like NIST or CIS?

Keep studying — Cloud Fundamentals and Shared Responsibility