A company is using a cloud provider's platform-as-a-service (PaaS) offering to host a web application. The provider manages the runtime environment and the operating system. Which security task is still the customer's responsibility?

Securing the physical data center.

Patching the underlying operating system.

Managing the application code and its dependencies.

Configuring the network firewall at the hypervisor level.

A company is using a hybrid cloud environment with both on-premises and cloud resources. The security team is defining responsibilities for a new application that uses an IaaS virtual machine in the cloud and an on-premises database. Which party is responsible for patching the guest OS of the cloud VM?

The on-premises team, because the database is on-premises.

The customer, because the VM is an IaaS resource and the guest OS is customer-managed.

The cloud provider, because the VM is in their data center.

The provider, only if the customer uses a managed VM service.

A security team is using threat intelligence to improve their cloud security posture. The intelligence indicates that adversaries are using a technique called 'living off the land' by abusing legitimate cloud management tools to perform malicious actions. Which control would be most effective in detecting this behavior?

Use a traditional antivirus solution on cloud management consoles.

Disable all cloud management APIs.

Block all access to cloud management tools from the internet.

Implement user and entity behavior analytics (UEBA) to detect anomalous use of management tools.

A threat intelligence report indicates that adversaries are using phishing emails to obtain cloud console credentials and then modifying multi-factor authentication settings to lock out legitimate users. Which control would be most effective in mitigating this attack chain?

Deploy an email gateway that blocks all external emails.

Implement a conditional access policy that requires MFA from trusted locations only.

Use a single sign-on provider that does not support MFA.

Disable multi-factor authentication to simplify the login process.

GIAC Cloud Security Essentials

Domain 1Objective 2

Understanding Shared Responsibility and Threat Informed Defense GCLD Practice Questions (Page 4)

Part of the Cloud Fundamentals and Shared Responsibility domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–19 in this domain), expect 3–5 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

2concepts

Questions 16–20

16application · medium
A company is using a cloud provider's platform-as-a-service (PaaS) offering to host a web application. The provider manages the runtime environment and the operating system. Which security task is still the customer's responsibility?
Select an answer first
17application · medium
A security operations center is using the MITRE ATT&CK framework to map observed adversary behavior. They notice that an attacker is using a legitimate cloud management API to create a new virtual machine for cryptocurrency mining. Which ATT&CK tactic does this behavior primarily represent?
Select an answer first
18expert · hard
A company is using a hybrid cloud environment with both on-premises and cloud resources. The security team is defining responsibilities for a new application that uses an IaaS virtual machine in the cloud and an on-premises database. Which party is responsible for patching the guest OS of the cloud VM?
Select an answer first
19expert · hard
A security team is using threat intelligence to improve their cloud security posture. The intelligence indicates that adversaries are using a technique called 'living off the land' by abusing legitimate cloud management tools to perform malicious actions. Which control would be most effective in detecting this behavior?
Select an answer first
20application · medium
A threat intelligence report indicates that adversaries are using phishing emails to obtain cloud console credentials and then modifying multi-factor authentication settings to lock out legitimate users. Which control would be most effective in mitigating this attack chain?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCLD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCLD” is a trademark of its owner, used for identification only.

Understanding Shared Responsibility and Threat Informed Defense GCLD Practice Questions (Page 4)

Questions 16–20

A company is using a cloud provider's platform-as-a-service (PaaS) offering to host a web application. The provider manages the runtime environment and the operating system. Which security task is still the customer's responsibility?

A security operations center is using the MITRE ATT&CK framework to map observed adversary behavior. They notice that an attacker is using a legitimate cloud management API to create a new virtual machine for cryptocurrency mining. Which ATT&CK tactic does this behavior primarily represent?

A threat intelligence report indicates that adversaries are using phishing emails to obtain cloud console credentials and then modifying multi-factor authentication settings to lock out legitimate users. Which control would be most effective in mitigating this attack chain?

Keep studying — Cloud Fundamentals and Shared Responsibility