A company is using a cloud provider's IaaS to host a web application that processes personal data of EU citizens. The provider has a data center in the EU and offers a data processing agreement (DPA). The company's security team is concerned about the provider's ability to access the data. Which control should the company implement to protect data from provider access?

Use client-side encryption for data stored in the cloud

Use a VPN to connect to the cloud

Rely on the provider's DPA to restrict access

A security team is implementing a risk monitoring process for a cloud environment. They need to detect misconfigurations in real time. Which approach is most effective?

Automated configuration scanning and alerting

Reviewing logs after an incident

Training employees on best practices

A company is using a cloud provider's infrastructure-as-a-service (IaaS) offering. The company is responsible for patching the operating system of their virtual machines. Which additional responsibility does the company retain?

Patching the host operating system

Configuring the virtual network

Securing the physical data center

A security team is evaluating the risk of a cloud misconfiguration that could expose customer data. The team has limited resources and must prioritize risks. Which approach best aligns with risk management principles?

Prioritize risks based on likelihood and impact

Focus only on risks that have occurred before

Transfer all risks to the cloud provider

Mitigate all identified risks equally

A company is using a cloud provider's IaaS to host a database. The provider offers encryption at rest by default. The company's compliance team wants to ensure that the encryption keys are managed by the company. Which option should they choose?

Disable encryption and rely on network security

Use a third-party encryption solution

Use the provider's default encryption

Use customer-managed keys (CMK) for encryption

GIAC Cloud Security Essentials

Domain 1Objective 4

Risk Management and Compliance GCLD Practice Questions (Page 9)

Part of the Cloud Fundamentals and Shared Responsibility domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–19 in this domain), expect 3–5 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

5concepts

Questions 41–45

41expert · hard
A company is using a cloud provider's IaaS to host a web application that processes personal data of EU citizens. The provider has a data center in the EU and offers a data processing agreement (DPA). The company's security team is concerned about the provider's ability to access the data. Which control should the company implement to protect data from provider access?
Select an answer first
42expert · medium
A security team is implementing a risk monitoring process for a cloud environment. They need to detect misconfigurations in real time. Which approach is most effective?
Select an answer first
43expert · hard
A company is using a cloud provider's infrastructure-as-a-service (IaaS) offering. The company is responsible for patching the operating system of their virtual machines. Which additional responsibility does the company retain?
Select an answer first
44expert · medium
A security team is evaluating the risk of a cloud misconfiguration that could expose customer data. The team has limited resources and must prioritize risks. Which approach best aligns with risk management principles?
Select an answer first
45expert · hard
A company is using a cloud provider's IaaS to host a database. The provider offers encryption at rest by default. The company's compliance team wants to ensure that the encryption keys are managed by the company. Which option should they choose?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCLD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCLD” is a trademark of its owner, used for identification only.