A company is deploying a web application that uses a cloud database. The application instances and the database are in the same VPC. The security team requires that all data be encrypted in transit and at rest. Which set of controls should the architect implement?

Use a VPN between the application and the database, and rely on the VPC's default encryption for data at rest.

Place the database in a separate subnet and use network ACLs to restrict access, assuming the network isolation provides encryption.

Enable TLS for connections between the application and the database, and enable database encryption at rest using the cloud provider's managed encryption.

Use a load balancer in front of the database to terminate TLS, and store data in plaintext to avoid performance overhead.

Which cloud service is commonly used to aggregate and analyze network logs for security monitoring?

Cloud logging and monitoring service (e.g., CloudWatch, Azure Monitor)

A security analyst is investigating a potential data exfiltration from a cloud VPC. They have enabled VPC flow logs and want to identify if any large amounts of data were transferred to an external IP address. Which approach should they use?

Use a packet capture on the instance to see the data being sent.

Check the network ACL rules to see if outbound traffic to the external IP was allowed.

Query the flow logs for traffic to the external IP and sum the bytes transferred.

Review the security group rules to see if outbound traffic was allowed.

In the shared responsibility model for cloud networking, which of the following is typically the responsibility of the cloud customer?

Ensuring the availability of the cloud provider's regional network backbone

Configuring network access control lists (ACLs) on subnets

Patching the hypervisor that hosts virtual machines

Maintaining the physical routers in the cloud provider's data center

GIAC Cloud Security Essentials

Domain 2Objective 2

Securing Cloud Networks GCLD Practice Questions (Page 6)

Part of the Cloud Networking and Security domain, which makes up ~16% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–13 in this domain), expect 3–4 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

7concepts

Questions 26–29

26application · medium
A company is deploying a web application that uses a cloud database. The application instances and the database are in the same VPC. The security team requires that all data be encrypted in transit and at rest. Which set of controls should the architect implement?
Select an answer first
27foundation · easy
Which cloud service is commonly used to aggregate and analyze network logs for security monitoring?
Select an answer first
28application · medium
A security analyst is investigating a potential data exfiltration from a cloud VPC. They have enabled VPC flow logs and want to identify if any large amounts of data were transferred to an external IP address. Which approach should they use?
Select an answer first
29foundation · easy
In the shared responsibility model for cloud networking, which of the following is typically the responsibility of the cloud customer?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCLD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCLD” is a trademark of its owner, used for identification only.