A company is deploying a VM that will run a containerized application. The security team wants to ensure that the VM is hardened and that the container runtime is secure. Which combination of measures provides the most comprehensive security?

Use a full-featured base image and rely on the container runtime's default security settings.

Use a minimal base image, disable unnecessary kernel modules, run containers with read-only root filesystems, and enable audit logging.

Run containers in privileged mode to simplify configuration.

Disable audit logging to improve performance.

A company is creating a golden image for its Linux compute instances. The security team requires that the image be hardened, that all data volumes created from the image be encrypted, and that the image itself be shared only within the organization. Which steps should the team take?

Enable automatic patch installation, keep all default services, and use a shared public image to simplify deployment.

Remove unnecessary packages, apply the latest patches, enable a host-based firewall, and configure the image to use encrypted volumes by default.

Disable all network services, remove the SSH server, and do not encrypt volumes because the image is internal.

Install a full desktop environment, apply only critical patches, and rely on the cloud provider's default volume encryption.

A security analyst notices that a cloud VM is sending a large amount of outbound traffic to an unknown IP address. The VM is supposed to run a simple web server. The analyst wants to investigate and also prevent similar incidents in the future. What should the analyst do first?

Review the VM's audit logs and outbound network flow logs to identify the process and destination.

Disable the VM's metadata service to prevent credential theft.

Change the VM's security group to block all outbound traffic.

Immediately terminate the VM to stop the traffic and then restore from the latest backup.

A developer is deploying an application that needs to access a database and an object storage bucket. The developer wants to avoid storing any credentials in the application code or configuration files. The security team requires that the application's permissions be scoped to only the necessary resources. Which approach should be used?

Attach two IAM roles to the VM: one for database access and one for storage access, each with minimal permissions.

Use the VM's default service account, which has broad permissions to all services.

Create a single IAM user with permissions for both database and storage, and store the access key in the VM's metadata.

Embed the database password and storage access key in the application's environment variables.

A cloud engineer needs to allow an application running on VM1 to read from a storage bucket and write logs to a logging service. The engineer wants to follow the principle of least privilege. What should the engineer do?

Attach the default service account to VM1, which has broad permissions.

Create an IAM role with read-only access to the bucket and write-only access to the logging service, and attach it to VM1.

Use a shared access key for the bucket and logging service and embed it in the application code.

Create an IAM user with full access to all services and store the credentials on VM1.

GIAC Cloud Security Essentials

Domain 4Objective 1

Secure Compute Deployment GCLD Practice Questions (Page 2)

Part of the Compute, Storage, and Containers domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 3–5 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

7concepts

Questions 6–10

6expert · hard
A company is deploying a VM that will run a containerized application. The security team wants to ensure that the VM is hardened and that the container runtime is secure. Which combination of measures provides the most comprehensive security?
Select an answer first
7application · medium
A company is creating a golden image for its Linux compute instances. The security team requires that the image be hardened, that all data volumes created from the image be encrypted, and that the image itself be shared only within the organization. Which steps should the team take?
Select an answer first
8application · medium
A security analyst notices that a cloud VM is sending a large amount of outbound traffic to an unknown IP address. The VM is supposed to run a simple web server. The analyst wants to investigate and also prevent similar incidents in the future. What should the analyst do first?
Select an answer first
9expert · hard
A developer is deploying an application that needs to access a database and an object storage bucket. The developer wants to avoid storing any credentials in the application code or configuration files. The security team requires that the application's permissions be scoped to only the necessary resources. Which approach should be used?
Select an answer first
10application · medium
A cloud engineer needs to allow an application running on VM1 to read from a storage bucket and write logs to a logging service. The engineer wants to follow the principle of least privilege. What should the engineer do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCLD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCLD” is a trademark of its owner, used for identification only.