A company uses a public cloud IaaS environment. They are adopting the NIST Cybersecurity Framework and need to assign responsibility for a control that requires patching the operating system of their virtual machines. According to the shared responsibility model, who is responsible for this control?

The cloud provider, because they own the physical hardware

Shared equally between provider and customer

The cloud provider, because they manage all software in IaaS

The cloud customer, because they manage the guest OS

A company uses a cloud provider's IaaS offering and adopts the NIST Cybersecurity Framework to guide its security program. According to the shared responsibility model, which activity is the company responsible for?

Configuring the hypervisor's security settings

Patching the operating system of its virtual machines

Replacing failed hardware in the provider's server racks

Ensuring the physical security of the data center where its virtual machines run

A cloud architect is using the CSA Cloud Controls Matrix (CCM) to guide the security design of a new application. Which activity is an example of applying the CCM to the architecture?

Choosing a region that meets data residency requirements

Selecting a cloud provider that offers the most compute capacity

Mapping the application's data storage design to the CCM control for 'Data Encryption & Integrity'

Verifying that the cloud provider has a SOC 2 report

A company is using a PaaS service to host a web application. They are using the CSA Cloud Controls Matrix to assess their responsibilities. Which control is MOST likely to be the customer's responsibility?

Application-level authentication and authorization

A security team is applying the CIS Critical Security Controls to a cloud environment. They need to implement a control that helps detect unauthorized configuration changes in their cloud resources. Which CIS Control is most directly applicable?

Continuous Vulnerability Management

Secure Configuration of Enterprise Assets and Software

GIAC Cloud Security Essentials

Domain 1Objective 3

Frameworks for Built-In Security GCLD Practice Questions (Page 6)

Part of the Cloud Fundamentals and Shared Responsibility domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–19 in this domain), expect 3–5 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

3concepts

Questions 26–30

26application · medium
A company uses a public cloud IaaS environment. They are adopting the NIST Cybersecurity Framework and need to assign responsibility for a control that requires patching the operating system of their virtual machines. According to the shared responsibility model, who is responsible for this control?
Select an answer first
27foundation · easy
A company uses a cloud provider's IaaS offering and adopts the NIST Cybersecurity Framework to guide its security program. According to the shared responsibility model, which activity is the company responsible for?
Select an answer first
28foundation · easy
A cloud architect is using the CSA Cloud Controls Matrix (CCM) to guide the security design of a new application. Which activity is an example of applying the CCM to the architecture?
Select an answer first
29application · medium
A company is using a PaaS service to host a web application. They are using the CSA Cloud Controls Matrix to assess their responsibilities. Which control is MOST likely to be the customer's responsibility?
Select an answer first
30application · medium
A security team is applying the CIS Critical Security Controls to a cloud environment. They need to implement a control that helps detect unauthorized configuration changes in their cloud resources. Which CIS Control is most directly applicable?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCLD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCLD” is a trademark of its owner, used for identification only.