A company is deploying a VM that will process sensitive customer data. The data must be encrypted both when stored on the VM's disk and when transmitted to a central database. Which two actions should be taken?

Enable disk encryption on the VM and require TLS for all connections to the database.

Enable disk encryption and use a private network for database connections.

Encrypt the database password and store it in the VM's environment variables.

Use TLS for database connections and rely on the cloud provider's default disk encryption.

A company must ensure that all cloud VMs are tagged with an owner and a cost center, and that no VM can be created without these tags. Which governance control should be implemented?

Send a reminder email to all developers to tag their VMs.

Rely on the cloud provider's default tagging of all resources.

Use a policy that requires mandatory tags on VM creation and denies creation if tags are missing.

Create a script that adds tags to all existing VMs after they are created.

Which action is a recommended hardening technique for a newly deployed compute instance?

Disable unnecessary services and apply the latest security patches

Use default passwords for administrative accounts

Skip patch installation to avoid downtime

Enable all available services to ensure functionality

A company is deploying a VM that will host a web application. The application must be accessible over HTTPS from the internet. The security team wants to ensure that all traffic is encrypted and that the VM is not directly exposed to the internet. Which architecture best meets these requirements?

Use a VPN to allow internet users to access the VM.

Place the VM in a public subnet and use a security group that allows all traffic.

Place the VM behind a load balancer that terminates HTTPS and forwards traffic to the VM over HTTP within the VPC.

Assign a public IP to the VM and configure the security group to allow HTTPS from the internet.

GIAC Cloud Security Essentials

Domain 4Objective 1

Secure Compute Deployment GCLD Practice Questions (Page 6)

Part of the Compute, Storage, and Containers domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 3–5 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

7concepts

Questions 26–30

26application · medium
A company is deploying a VM that will process sensitive customer data. The data must be encrypted both when stored on the VM's disk and when transmitted to a central database. Which two actions should be taken?
Select an answer first
27application · medium
A company must ensure that all cloud VMs are tagged with an owner and a cost center, and that no VM can be created without these tags. Which governance control should be implemented?
Select an answer first
28foundation · easy
Which action is a recommended hardening technique for a newly deployed compute instance?
Select an answer first
29expert · hard
A company is deploying a VM that will host a web application. The application must be accessible over HTTPS from the internet. The security team wants to ensure that all traffic is encrypted and that the VM is not directly exposed to the internet. Which architecture best meets these requirements?
Select an answer first
30foundation · easy
Which security strategy involves implementing multiple layers of controls so that if one control fails, another is in place to protect the resource?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCLD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCLD” is a trademark of its owner, used for identification only.