Automated Cloud Remediation GCSA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security operations team is creating a remediation playbook for a common issue: an Azure VM that has been assigned a public IP address when it should be internal-only. The playbook must be safe to run automatically and must not disrupt the VM's operation. Which step sequence should the playbook include?

   • ADelete the VM and recreate it without a public IP address using an ARM template.
   • BChange the network security group to deny all inbound traffic from the internet, leaving the public IP in place.
   • CDisassociate the public IP address from the VM's network interface, then verify that the VM still has a private IP address and is reachable on the internal network.
   • DStop the VM, remove the public IP address, and then start the VM.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company uses Terraform to manage its cloud infrastructure. A security policy requires that all S3 buckets have encryption enabled. The team wants to ensure that any bucket created without encryption is automatically corrected. Which approach aligns with infrastructure-as-code remediation?

   • ACreate a remediation playbook that a developer runs manually to add encryption to any bucket that is missing it.
   • BModify the Terraform module to include encryption as a required setting, then run `terraform apply` to update existing buckets.
   • CAdd a policy-as-code check to the CI pipeline that fails the build if a bucket lacks encryption, and require a developer to fix the code.
   • DUse a serverless function that detects unencrypted buckets and applies the encryption setting directly to the bucket.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company manages its cloud infrastructure using Terraform. A security scan reveals that a security group in the production environment has an unauthorized inbound rule. The team wants to correct this using infrastructure-as-code practices so that the fix is permanent and reviewable. What is the best way to remediate this issue?

   • ACreate a new Terraform module that recreates the security group from scratch and apply it to replace the existing one.
   • BUse the AWS CLI to remove the unauthorized rule directly from the security group.
   • CRun 'terraform refresh' to update the state file to match the actual infrastructure, then run 'terraform apply'.
   • DUpdate the Terraform configuration to remove the unauthorized rule, then run 'terraform plan' and 'terraform apply' to bring the infrastructure back to the desired state.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security team is designing an event-driven remediation system for a multi-account AWS environment. The system must respond to findings from AWS GuardDuty, such as a compromised EC2 instance, by isolating the instance. The team wants to ensure that the remediation action is logged for audit and that it does not affect other accounts. Which design best meets these requirements?

   • AUse a single Lambda function in the management account that isolates instances in all accounts using cross-account IAM roles.
   • BConfigure GuardDuty in each account to send findings directly to a Lambda function in the same account, which isolates the instance and logs to a local CloudWatch log group.
   • CUse a centralized GuardDuty detector that sends findings to a central EventBridge bus, which triggers a Lambda function in the account where the finding occurred to isolate the instance and log the action to a central S3 bucket.
   • DCreate a playbook that a security analyst runs manually when they receive a GuardDuty alert.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which of the following is an example of an event-driven trigger for automated remediation?

   • AA security finding published to a message queue
   • BA monthly compliance report generated by a third-party auditor
   • CA scheduled cron job that runs every hour
   • DA manual command executed by a cloud administrator
   Reveal Solution Discussion Select an answer first