A healthcare startup is moving its patient-facing web application to a cloud provider using a PaaS offering. The application stores protected health information (PHI) in a managed database. The security team is mapping responsibilities for HIPAA compliance. Which responsibility remains with the customer in this PaaS model?

Managing the physical security of the data center hosting the database

Ensuring the database software is updated with the latest security patches

Configuring the application's authentication and access controls

Patching the underlying operating system of the database server

Which of the following is a common cloud-specific risk that organizations must evaluate during a cloud risk assessment?

Inability to scale resources due to hardware limits

Physical theft of servers from the provider's data center

Loss of the provider's encryption keys

Misconfiguration of cloud resources leading to data exposure

A company is using a cloud provider's SaaS email service. The company is subject to HIPAA and needs to ensure that PHI is protected. The provider offers a BAA. Which of the following is the most important action for the company to take?

Use a different email service that does not require a BAA

Rely on the BAA to ensure compliance

Configure the email service to encrypt messages containing PHI

Ensure the provider has a SOC 2 report

A company is evaluating a cloud provider for a workload that must comply with GDPR. The provider offers a data center in the EU and publishes an ISO 27001 certification. What does the provider's ISO 27001 certification demonstrate?

The provider is exempt from GDPR obligations

The provider guarantees data residency in the EU

The provider is automatically GDPR compliant

The provider's information security management system meets an international standard

A company is using a cloud provider's software-as-a-service (SaaS) application for customer relationship management. The provider is responsible for the security of the application. Which responsibility does the customer retain?

Managing the underlying infrastructure

Configuring user access and permissions

GIAC Cloud Security Essentials

Domain 1Objective 4

Risk Management and Compliance GCLD Practice Questions (Page 1)

Part of the Cloud Fundamentals and Shared Responsibility domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–19 in this domain), expect 3–5 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

5concepts

Questions 1–5

1application · medium
A healthcare startup is moving its patient-facing web application to a cloud provider using a PaaS offering. The application stores protected health information (PHI) in a managed database. The security team is mapping responsibilities for HIPAA compliance. Which responsibility remains with the customer in this PaaS model?
Select an answer first
2foundation · easy
Which of the following is a common cloud-specific risk that organizations must evaluate during a cloud risk assessment?
Select an answer first
3expert · hard
A company is using a cloud provider's SaaS email service. The company is subject to HIPAA and needs to ensure that PHI is protected. The provider offers a BAA. Which of the following is the most important action for the company to take?
Select an answer first
4application · medium
A company is evaluating a cloud provider for a workload that must comply with GDPR. The provider offers a data center in the EU and publishes an ISO 27001 certification. What does the provider's ISO 27001 certification demonstrate?
Select an answer first
5expert · medium
A company is using a cloud provider's software-as-a-service (SaaS) application for customer relationship management. The provider is responsible for the security of the application. Which responsibility does the customer retain?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCLD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCLD” is a trademark of its owner, used for identification only.