How does infrastructure as code (IaC) support automated remediation?

By eliminating the need for security policies

By providing a graphical interface to manage cloud resources

By allowing the infrastructure to be defined in code, so that misconfigurations can be corrected by reapplying the desired state

By making all infrastructure changes manual and requiring human approval

How does automated remediation typically handle compliance drift?

By detecting the drift and automatically reapplying the compliant baseline configuration

By ignoring the drift until the next scheduled audit

By deleting the drifted resources and recreating them from scratch

By updating the compliance baseline to match the drifted configuration

A company uses CloudFormation to deploy its infrastructure. A security audit reveals that some resources were manually modified outside of CloudFormation, causing drift. The team wants to use infrastructure-as-code to remediate the drift. What is the best approach?

Ignore the drift and only fix it during the next scheduled deployment.

Delete the stack and recreate it from the template.

Manually fix the resources in the AWS console to match the template.

Run `aws cloudformation update-stack` with the original template to revert the resources to the template-defined state.

What is a common use case for a remediation playbook?

Deleting all user accounts that have not logged in for a day

Automatically closing an open security group port that is not allowed by policy

Generating a monthly summary of security incidents

Manually reviewing every security alert before taking action

A security team has implemented automated remediation for a set of security findings. The compliance team requires a report that shows the number of findings detected, the number remediated, the number that failed, and the time taken for each remediation. The team wants to generate this report automatically. What is the best way to meet this requirement?

Store all remediation actions in a structured log (e.g., JSON) and use a reporting tool to aggregate and visualize the data.

Send an email to the compliance team after each remediation action.

Create a dashboard that shows only the current status of remediation actions.

Use a spreadsheet that the security team updates manually.

GIAC Cloud Security Automation

Domain 2Objective 1

Automated Cloud Remediation GCSA Practice Questions (Page 5)

Part of the Cloud Security Automation and Compliance domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

9concepts

Questions 21–25

21foundation · easy
How does infrastructure as code (IaC) support automated remediation?
Select an answer first
22foundation · easy
How does automated remediation typically handle compliance drift?
Select an answer first
23application · medium
A company uses CloudFormation to deploy its infrastructure. A security audit reveals that some resources were manually modified outside of CloudFormation, causing drift. The team wants to use infrastructure-as-code to remediate the drift. What is the best approach?
Select an answer first
24foundation · easy
What is a common use case for a remediation playbook?
Select an answer first
25expert · hard
A security team has implemented automated remediation for a set of security findings. The compliance team requires a report that shows the number of findings detected, the number remediated, the number that failed, and the time taken for each remediation. The team wants to generate this report automatically. What is the best way to meet this requirement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.