A company is moving from an on-premises data center to a cloud provider's PaaS offering. The security team is concerned about losing visibility into network traffic. Which approach best addresses this concern while using PaaS?

Use a third-party agent installed on the PaaS runtime to capture network packets.

Deploy a network intrusion detection system on the underlying infrastructure.

Use the provider's built-in logging and monitoring tools to gain visibility into application-level traffic.

Request that the provider give raw network packet captures from the physical network.

A company is migrating a legacy application from an on-premises data center to a cloud provider's infrastructure-as-a-service (IaaS) offering. The application runs on a virtual machine with a custom operating system image. Which security control remains the customer's responsibility after the migration?

Managing the physical access controls to the server racks.

Patching the guest operating system of the virtual machine.

Securing the physical network switches in the provider's data center.

Updating the hypervisor firmware.

A threat intelligence report describes an adversary group that uses compromised service accounts to access cloud APIs and then creates snapshots of virtual machines to exfiltrate data. Which control is most directly informed by this threat pattern?

Restricting snapshot permissions to specific administrative roles and monitoring snapshot creation.

Implementing network segmentation between the VM and storage.

Enabling encryption on the snapshots.

Deploying a data loss prevention (DLP) tool for the storage service.

A security team is reviewing threat intelligence that shows an adversary group uses exposed cloud storage buckets to harvest sensitive data. The team must implement a control that balances security with the need for some buckets to be publicly accessible for a public website. Which control is most appropriate?

Making all buckets private and using a CDN for public content.

Using a single public bucket for all data.

Keeping public buckets but adding encryption.

Disabling all public access and not serving the website.

A company is migrating a customer-facing web application to a cloud provider using a platform-as-a-service (PaaS) offering. The security team is updating the incident response runbook and needs to document which party is responsible for patching the operating system of the application host. According to the shared responsibility model, who is responsible for patching the OS?

The customer, because they manage the application and its dependencies.

The cloud provider, because the OS is part of the underlying platform in PaaS.

The customer, because they chose the PaaS service and must patch the underlying OS.

The provider, only if the customer purchased a managed support plan.

GIAC Cloud Security Essentials

Domain 1Objective 2

Understanding Shared Responsibility and Threat Informed Defense GCLD Practice Questions (Page 6)

Part of the Cloud Fundamentals and Shared Responsibility domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–19 in this domain), expect 3–5 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

2concepts

Questions 26–30

26expert · hard
A company is moving from an on-premises data center to a cloud provider's PaaS offering. The security team is concerned about losing visibility into network traffic. Which approach best addresses this concern while using PaaS?
Select an answer first
27application · medium
A company is migrating a legacy application from an on-premises data center to a cloud provider's infrastructure-as-a-service (IaaS) offering. The application runs on a virtual machine with a custom operating system image. Which security control remains the customer's responsibility after the migration?
Select an answer first
28application · medium
A threat intelligence report describes an adversary group that uses compromised service accounts to access cloud APIs and then creates snapshots of virtual machines to exfiltrate data. Which control is most directly informed by this threat pattern?
Select an answer first
29expert · hard
A security team is reviewing threat intelligence that shows an adversary group uses exposed cloud storage buckets to harvest sensitive data. The team must implement a control that balances security with the need for some buckets to be publicly accessible for a public website. Which control is most appropriate?
Select an answer first
30application · medium
A company is migrating a customer-facing web application to a cloud provider using a platform-as-a-service (PaaS) offering. The security team is updating the incident response runbook and needs to document which party is responsible for patching the operating system of the application host. According to the shared responsibility model, who is responsible for patching the OS?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCLD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCLD” is a trademark of its owner, used for identification only.

Understanding Shared Responsibility and Threat Informed Defense GCLD Practice Questions (Page 6)

Questions 26–30

A company is moving from an on-premises data center to a cloud provider's PaaS offering. The security team is concerned about losing visibility into network traffic. Which approach best addresses this concern while using PaaS?

A threat intelligence report describes an adversary group that uses compromised service accounts to access cloud APIs and then creates snapshots of virtual machines to exfiltrate data. Which control is most directly informed by this threat pattern?

Keep studying — Cloud Fundamentals and Shared Responsibility