Automated Cloud Remediation GCSA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which sequence best represents the core steps in an automated remediation workflow?

   • ATrigger corrective action → Detect violation → Log the outcome → Verify resolution
   • BVerify resolution → Log the outcome → Detect violation → Trigger corrective action
   • CDetect violation → Trigger corrective action → Verify resolution → Log the outcome
   • DLog the outcome → Detect violation → Verify resolution → Trigger corrective action
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is a remediation playbook?

   • AA document that lists all security policies in an organization
   • BA predefined set of step-by-step instructions for responding to a specific security issue
   • CA type of firewall rule that blocks malicious traffic
   • DA tool that automatically generates security reports
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is a key benefit of using infrastructure as code for remediation?

   • AIt eliminates the need for monitoring and detection
   • BIt guarantees that no security misconfigurations will ever occur
   • CIt ensures that remediation actions are consistent and repeatable
   • DIt allows remediation to be performed only by senior engineers
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security engineer is implementing compliance drift detection for a set of Azure resources that must adhere to a corporate baseline. The engineer wants to automatically remediate any drift and also generate a report for auditors. Which combination of services should the engineer use?

   • AAzure Blueprints to assign the baseline, and Azure Service Health to report on remediation actions.
   • BAzure Policy with a DeployIfNotExists effect, paired with Azure Monitor to log remediation actions and generate compliance reports.
   • CAzure Security Center with a recommendation to manually fix the drift, and Azure Sentinel to create a workbook for reporting.
   • DAzure Resource Graph to query for non-compliant resources, and a Logic App to send an email to the security team.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security engineer is designing an automated remediation workflow for a multi-account AWS environment. The team wants to automatically revoke overly permissive security group rules as soon as they are created. The engineer must ensure that the workflow can distinguish between a legitimate change made by the networking team and a misconfiguration, and must avoid disrupting active workloads. Which approach best meets these requirements?

   • ACreate an AWS Config rule that triggers a Lambda function to remove any security group rule that allows 0.0.0.0/0, and log the action to CloudTrail.
   • BDeploy a Lambda function that runs every hour, compares the current security group rules to a stored baseline, and reverts any changes that differ from the baseline.
   • CConfigure an AWS Config rule to detect security group rules that allow 0.0.0.0/0, then trigger a Systems Manager Automation document that first checks if the rule was created by the networking team's IAM role, and if not, removes the rule and posts a message to a Slack channel.
   • DUse an event-driven rule on AWS CloudTrail that invokes a Lambda function to tag the security group as 'review-required' and send a notification, leaving the rule in place until a human approves the change.
   Reveal Solution Discussion Select an answer first