An organization has a compliance baseline that requires all virtual machines to have disk encryption enabled. A compliance monitoring tool detects that a VM has been created without disk encryption. The team wants to automatically remediate this drift. What is the first step in designing the remediation workflow?

Define the desired state and the specific corrective action to bring the VM into compliance.

Immediately delete the non-compliant VM to prevent data exposure.

Create a report of all non-compliant VMs and schedule a weekly review.

Send an alert to the security team and wait for manual approval.

An organization uses Terraform to manage its cloud infrastructure. A compliance baseline requires that all storage buckets have versioning enabled. A recent audit found that several buckets have versioning disabled because they were created outside of Terraform. The team wants to remediate this drift using infrastructure-as-code. What is the best approach?

Update the Terraform code to require versioning and run `terraform plan` to see the changes.

Delete the non-compliant buckets and recreate them using Terraform.

Import the non-compliant buckets into the Terraform state, add the versioning configuration to the Terraform code, and run `terraform apply`.

Use a script to enable versioning on the non-compliant buckets directly via the cloud provider API.

A development team uses a policy-as-code tool (e.g., Open Policy Agent) to enforce security policies on Kubernetes resources. The team wants to automatically remediate any resource that violates a policy. What is the most effective way to integrate policy-as-code with remediation?

Use a mutating admission webhook that applies the policy's corrective action to the resource before it is created.

Use a validating admission webhook that rejects any resource that violates the policy.

Send an alert to the security team when a policy violation is detected.

Run a scheduled job that scans for policy violations and deletes the violating resources.

How does policy-as-code integration typically initiate automated remediation?

By disabling the affected resource until a human approves the change

By automatically modifying the policy code to allow the violation

By sending a notification to a security analyst for manual action

By evaluating resources against policies and triggering a remediation workflow when a violation is detected

What is the primary purpose of monitoring automated remediation activities?

To replace the need for security incident response teams

To ensure that remediation actions are never logged

To track the effectiveness of remediation and identify any failures or unintended consequences

To automatically increase the cloud budget when remediation occurs

GIAC Cloud Security Automation

Domain 2Objective 1

Automated Cloud Remediation GCSA Practice Questions (Page 3)

Part of the Cloud Security Automation and Compliance domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

9concepts

Questions 11–15

11application · medium
An organization has a compliance baseline that requires all virtual machines to have disk encryption enabled. A compliance monitoring tool detects that a VM has been created without disk encryption. The team wants to automatically remediate this drift. What is the first step in designing the remediation workflow?
Select an answer first
12expert · hard
An organization uses Terraform to manage its cloud infrastructure. A compliance baseline requires that all storage buckets have versioning enabled. A recent audit found that several buckets have versioning disabled because they were created outside of Terraform. The team wants to remediate this drift using infrastructure-as-code. What is the best approach?
Select an answer first
13application · medium
A development team uses a policy-as-code tool (e.g., Open Policy Agent) to enforce security policies on Kubernetes resources. The team wants to automatically remediate any resource that violates a policy. What is the most effective way to integrate policy-as-code with remediation?
Select an answer first
14foundation · easy
How does policy-as-code integration typically initiate automated remediation?
Select an answer first
15foundation · easy
What is the primary purpose of monitoring automated remediation activities?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.

Automated Cloud Remediation GCSA Practice Questions (Page 3)

Questions 11–15

A development team uses a policy-as-code tool (e.g., Open Policy Agent) to enforce security policies on Kubernetes resources. The team wants to automatically remediate any resource that violates a policy. What is the most effective way to integrate policy-as-code with remediation?

How does policy-as-code integration typically initiate automated remediation?

What is the primary purpose of monitoring automated remediation activities?

Keep studying — Cloud Security Automation and Compliance