What is the primary purpose of automated remediation in cloud security automation?

To automatically correct security violations and misconfigurations without manual intervention

To generate compliance reports for auditors after a breach occurs

To manually review and approve every security change in the cloud environment

To replace the need for security policies and compliance frameworks

A security team is creating a playbook to remediate an IAM user that has an access key that has not been rotated in 90 days. The playbook must be safe to run automatically and must not lock out the user. Which step should the playbook include?

Delete the access key immediately and notify the user.

Disable the access key, notify the user, and then delete the key after a grace period if the user has not rotated it.

Create a new access key for the user and delete the old one in the same step.

Change the user's password to force a re-authentication, and then rotate the access key.

What is a critical design consideration when building an automated remediation workflow?

Making the workflow as complex as possible to handle all edge cases

Requiring manual approval for every step to ensure accuracy

Ensuring the workflow can run without any logging or audit trail

Including a rollback or reversal mechanism in case the corrective action fails

What is compliance drift in a cloud environment?

The gradual degradation of cloud performance over time

The difference between the actual configuration of resources and the desired compliance baseline

The process of moving workloads between cloud providers

The automatic scaling of resources to meet demand

A cloud security team has implemented automated remediation for several security findings. The compliance team needs to provide auditors with evidence that remediation actions are effective and that the system is operating as intended. Which reporting approach should the team implement?

Create a dashboard that shows the current number of open findings and the number of remediated findings, but do not retain historical data.

Store remediation logs in a central S3 bucket and grant auditors read-only access to the bucket.

Configure the remediation system to send an email to the compliance team each time a remediation action is taken.

Send all remediation actions to a SIEM and generate a monthly report that includes the number of findings, the actions taken, and the success rate.

GIAC Cloud Security Automation

Domain 2Objective 1

Automated Cloud Remediation GCSA Practice Questions (Page 4)

Part of the Cloud Security Automation and Compliance domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

9concepts

Questions 16–20

16foundation · easy
What is the primary purpose of automated remediation in cloud security automation?
Select an answer first
17application · medium
A security team is creating a playbook to remediate an IAM user that has an access key that has not been rotated in 90 days. The playbook must be safe to run automatically and must not lock out the user. Which step should the playbook include?
Select an answer first
18foundation · easy
What is a critical design consideration when building an automated remediation workflow?
Select an answer first
19foundation · easy
What is compliance drift in a cloud environment?
Select an answer first
20application · medium
A cloud security team has implemented automated remediation for several security findings. The compliance team needs to provide auditors with evidence that remediation actions are effective and that the system is operating as intended. Which reporting approach should the team implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.