A company is migrating a legacy application to the cloud. The risk team identifies that the application's configuration management tool can inadvertently expose storage bucket permissions to the public if misconfigured. What is the most effective risk mitigation strategy?

Accept the risk because the application is legacy

Implement automated policy checks that detect and alert on public bucket permissions

Migrate the application to a different cloud provider

Train all developers on secure configuration practices

A company uses a cloud-based object storage service to store backups. The security team discovers that the backups are not encrypted and that the storage account is accessible from the public internet. They need to implement a risk mitigation strategy. Which combination of actions best reduces the risk?

Move the backups to a different region

Enable encryption and restrict network access to the storage account

A company is assessing the risk of a cloud provider's data breach. The provider has a history of breaches but offers strong encryption and monitoring. How should the company evaluate this risk?

Transfer the risk to the provider

Assume the risk is low because encryption is strong

Consider the provider's security controls and breach history

Ignore the breach history because the provider is certified

A company is migrating its on-premises data center to a public cloud. The risk team has identified that the migration could lead to data loss if the data transfer is interrupted. They want to implement a control to reduce the impact of this risk. Which control is most appropriate?

Use a faster internet connection for the transfer

Use a cloud provider's offline data transfer device

Transfer the data during off-peak hours

Maintain a backup of the data on-premises until the migration is verified

GIAC Cloud Security Essentials

Domain 1Objective 4

Risk Management and Compliance GCLD Practice Questions (Page 4)

Part of the Cloud Fundamentals and Shared Responsibility domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–19 in this domain), expect 3–5 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

5concepts

Questions 16–20

16application · medium
A company is migrating a legacy application to the cloud. The risk team identifies that the application's configuration management tool can inadvertently expose storage bucket permissions to the public if misconfigured. What is the most effective risk mitigation strategy?
Select an answer first
17foundation · easy
Which step in the risk management process involves determining the likelihood and impact of a identified risk?
Select an answer first
18application · medium
A company uses a cloud-based object storage service to store backups. The security team discovers that the backups are not encrypted and that the storage account is accessible from the public internet. They need to implement a risk mitigation strategy. Which combination of actions best reduces the risk?
Select an answer first
19expert · hard
A company is assessing the risk of a cloud provider's data breach. The provider has a history of breaches but offers strong encryption and monitoring. How should the company evaluate this risk?
Select an answer first
20expert · hard
A company is migrating its on-premises data center to a public cloud. The risk team has identified that the migration could lead to data loss if the data transfer is interrupted. They want to implement a control to reduce the impact of this risk. Which control is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCLD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCLD” is a trademark of its owner, used for identification only.

Risk Management and Compliance GCLD Practice Questions (Page 4)

Questions 16–20

A company is migrating a legacy application to the cloud. The risk team identifies that the application's configuration management tool can inadvertently expose storage bucket permissions to the public if misconfigured. What is the most effective risk mitigation strategy?

Which step in the risk management process involves determining the likelihood and impact of a identified risk?

A company is assessing the risk of a cloud provider's data breach. The provider has a history of breaches but offers strong encryption and monitoring. How should the company evaluate this risk?

A company is migrating its on-premises data center to a public cloud. The risk team has identified that the migration could lead to data loss if the data transfer is interrupted. They want to implement a control to reduce the impact of this risk. Which control is most appropriate?

Keep studying — Cloud Fundamentals and Shared Responsibility