GIAC (SANS)GIAC Cloud Security Automation
The GIAC Cloud Security Automation (GCSA) certification validates your ability to deploy systems and applications securely, with fluency in modern cloud and DevSecOps principles. It is designed for practitioners working in public cloud or DevOps environments who need to implement security controls throughout CI/CD pipelines. Earning GCSA demonstrates you can improve the reliability, integrity, and security of cloud native systems through automation and repeatable practices.
809 practice questions · Updated 2026-07-30
6Domains
18Objectives
143Concepts
809Questions
GCSA Curriculum
Every domain, objective, and concept the GCSA exam measures.
- DevOps Principles
- Continuous Integration (CI)
- Continuous Delivery (CD)
- Continuous Deployment
- Infrastructure as Code (IaC)
- Version Control
- Automated Testing
- Monitoring and Feedback
- DevOps Toolchain
- Cloud-Native Practices
- Secure CI/CD Pipeline Integration
- Immutable Infrastructure and Configuration Management
- Secrets Management in DevOps
- Container Security
- Infrastructure as Code (IaC) Security
- Automated Security Testing
- Compliance and Policy as Code
- Monitoring and Logging for DevOps
- Incident Response in DevOps
- Secure Software Supply Chain
- Infrastructure as Code (IaC) Fundamentals
- IaC Tools and Technologies
- Declarative vs. Imperative IaC
- IaC Configuration Management
- Idempotency and Drift Detection
- IaC Security and Compliance
- CI/CD Integration for IaC
- Testing and Validation of IaC
- Deployment Strategies and Rollback
- Monitoring and Auditing IaC Deployments
- Configuration Management Fundamentals
- Infrastructure as Code (IaC)
- Configuration Management Tools
- Declarative vs. Imperative Configuration
- Configuration Drift Detection
- Version Control for Configurations
- Configuration Management in CI/CD
- Security in Configuration Management
- Automated Remediation Fundamentals
- Remediation Workflow Design
- Policy-as-Code Integration
- Event-Driven Remediation
- Remediation Playbooks
- Infrastructure as Code Remediation
- Compliance Drift Detection
- Remediation Testing and Validation
- Remediation Monitoring and Reporting
- Compliance as Code Fundamentals
- Policy-as-Code Frameworks
- Infrastructure as Code (IaC) Compliance
- Continuous Compliance Monitoring
- Compliance Testing and Validation
- Remediation Automation
- Compliance Reporting and Auditing
- Integration with CI/CD Pipelines
- Version Control and Change Management for Compliance
- Cloud Provider Compliance Services
- Policy as Code
- Policy Enforcement Points
- Automated Policy Validation
- Policy Drift Detection
- Compliance Frameworks Mapping
- Policy Lifecycle Management
- Container Orchestration Fundamentals
- Orchestration Architecture
- Scheduling and Resource Management
- Service Discovery and Networking
- Scaling and Lifecycle Management
- Security Fundamentals in Orchestration
- Container Orchestration Risk Landscape
- Orchestrator Authentication Mechanisms
- Role-Based Access Control (RBAC) in Orchestration
- Access-Control Policies and Best Practices
- Securing the Orchestrator Control Plane
- Runtime Security Fundamentals
- Threat Detection and Monitoring
- Runtime Security Tools and Technologies
- Implementing Runtime Policies
- Incident Response and Remediation
- Integration with Orchestration Platforms
- Workload Isolation
- Pod Security Policies
- Runtime Security
- Secrets Management
- Network Policies
- Resource Quotas and Limits
- Image Security
- Workload Identity and Authentication
- Container Image Security
- Container Runtime Security
- Container Orchestration Security
- Container Registry Security
- Container Supply Chain Security
- Container Isolation and Sandboxing
- Container Monitoring and Auditing
- Container Lifecycle Security Automation
- Microservices Architecture Principles
- Deployment Strategies for Microservices
- Containerization in Microservices
- Service Discovery and Load Balancing
- API Gateway and Edge Services
- Configuration Management
- Observability and Monitoring
- Security in Microservices Deployment
- CI/CD Pipeline for Microservices
- Scaling and Resilience
- API Gateway Role in Microservices
- API Gateway Functions
- API Gateway Security
- API Gateway Deployment Patterns
- API Gateway Configuration and Management
- API Gateway Monitoring and Logging
- API Gateway Integration with Service Discovery
- API Gateway and Microservice Lifecycle
- Edge Identity Fundamentals
- Authentication Mechanisms at the Edge
- Identity Federation for Edge Services
- Edge Secrets Management
- Supply Chain Security for Edge Components
- Zero Trust for Edge Identity
- Secret Management Fundamentals
- Secret Storage Solutions
- Secret Rotation and Expiration
- Access Control for Secrets
- Secret Injection and Delivery
- Auditing and Monitoring Secret Usage
- Secret Management in CI/CD Pipelines
- Supply Chain Attack Vectors
- Dependency Management
- Artifact Integrity Verification
- Secure Build Pipelines
- Provenance and Attestation
- SBOM (Software Bill of Materials)
- Supply Chain Security Frameworks
- Incident Response for Supply Chain
- Cloud Native Observability Fundamentals
- Telemetry Data Types
- Observability vs. Monitoring
- Instrumentation Strategies
- OpenTelemetry Integration
- Observability Platforms and Tools
- Correlation and Analysis
- Best Practices for Cloud Native Observability
Ready to practice?Test your knowledge with exam-style questions or take an intelligent quiz tailored to your level.
Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for GCSA, so none is invented.