In the shared responsibility model, which party is typically responsible for patching the operating system of a virtual machine when using Infrastructure as a Service (IaaS)?

The provider, because they are responsible for all security in the cloud

The customer, but only if they have a support contract with the provider

The cloud provider, because they manage the hypervisor and physical hosts

The customer, because they control the guest operating system and its patches

A company is migrating a legacy application to the cloud. The application runs on a virtual machine and stores data in a managed database. The security team is concerned about the risk of data exfiltration through the VM's network interface. Which control is most effective in mitigating this risk?

Using a VPN to connect to the cloud

Encrypting the data at rest in the database

Enabling multi-factor authentication for the VM

Network security groups that restrict outbound traffic to approved destinations

A company is considering a cloud provider that offers a compliance certification for a specific framework. The company's auditor requires evidence that the certification is current and covers the services being used. What should the company do?

Request the provider's latest certification report and compare it to the services in scope

Accept the certification as valid indefinitely

Rely on the provider's marketing claims

Assume the certification covers all services

A cloud security team is performing a risk assessment for a new application. They identify that a misconfigured network firewall could expose internal services to the internet. According to risk management processes, what should the team do first?

Analyze the likelihood and impact of the misconfiguration

Accept the risk because the application is internal

Monitor the firewall logs for suspicious activity

Implement a firewall rule to block all inbound traffic

A company is migrating a workload that processes health records to the cloud. The compliance team requires that the workload be HIPAA compliant. The cloud provider offers a HIPAA-eligible service. What must the company do to achieve compliance?

Sign a business associate agreement (BAA) with the provider

Rely on the provider's HIPAA-eligible designation

GIAC Cloud Security Essentials

Domain 1Objective 4

Risk Management and Compliance GCLD Practice Questions (Page 8)

Part of the Cloud Fundamentals and Shared Responsibility domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–19 in this domain), expect 3–5 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

5concepts

Questions 36–40

36foundation · easy
In the shared responsibility model, which party is typically responsible for patching the operating system of a virtual machine when using Infrastructure as a Service (IaaS)?
Select an answer first
37expert · hard
A company is migrating a legacy application to the cloud. The application runs on a virtual machine and stores data in a managed database. The security team is concerned about the risk of data exfiltration through the VM's network interface. Which control is most effective in mitigating this risk?
Select an answer first
38expert · hard
A company is considering a cloud provider that offers a compliance certification for a specific framework. The company's auditor requires evidence that the certification is current and covers the services being used. What should the company do?
Select an answer first
39application · medium
A cloud security team is performing a risk assessment for a new application. They identify that a misconfigured network firewall could expose internal services to the internet. According to risk management processes, what should the team do first?
Select an answer first
40expert · hard
A company is migrating a workload that processes health records to the cloud. The compliance team requires that the workload be HIPAA compliant. The cloud provider offers a HIPAA-eligible service. What must the company do to achieve compliance?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCLD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCLD” is a trademark of its owner, used for identification only.