Automated Cloud Remediation GCSA Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the role of policy-as-code tools in automated remediation?

   • AThey replace the need for security monitoring and logging
   • BThey only generate compliance reports after a breach has occurred
   • CThey manually enforce security policies by requiring human review of every change
   • DThey define security policies in a machine-readable format that can be automatically evaluated and trigger remediation
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the key characteristic of event-driven remediation?

   • AIt requires manual initiation by a security analyst
   • BIt only works for compliance reporting, not actual remediation
   • CIt runs on a fixed schedule, such as nightly scans
   • DIt responds immediately to security findings as they occur
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A security engineer is designing an event-driven remediation system for a hybrid cloud environment. The system must respond to security findings from multiple sources (CSPM, SIEM, and custom detectors) and remediate them in a consistent manner. The engineer wants to avoid vendor lock-in and ensure that the remediation logic is reusable across different cloud providers. Which architecture should they choose?

   • AUse a serverless function in each cloud provider that is triggered by that provider's native event system, and duplicate the remediation logic in each function.
   • BUse a cloud-native event bus (e.g., AWS EventBridge) to ingest findings from all sources and trigger provider-specific Lambda functions for remediation.
   • CUse a centralized, cloud-agnostic message broker (e.g., Kafka) to collect findings, and a set of containerized remediation services that use multi-cloud SDKs to execute actions.
   • DUse a SIEM to aggregate all findings and have the SIEM's built-in automation engine perform the remediation actions.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security engineer is setting up compliance drift detection for a Kubernetes cluster. The team wants to automatically remediate any deployment that does not have the required resource limits set. The engineer must ensure that the remediation does not disrupt running applications. Which approach should they use?

   • AUse a Kubernetes admission controller that rejects any new deployment without resource limits, and then manually update existing deployments.
   • BUse Kubernetes namespaces to enforce resource limits, and rely on the namespace default limits to automatically apply to all deployments.
   • CRun a cron job that periodically checks all deployments and deletes any that do not have resource limits.
   • DUse a policy engine like OPA/Gatekeeper to detect deployments without resource limits, and then use a controller to automatically patch the deployment to add the required limits.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company uses a third-party CSPM tool that detects misconfigurations and sends findings to a webhook. The security team wants to automatically remediate a specific finding: an Azure storage account that has the 'allowBlobPublicAccess' property set to true. The team needs to ensure that the remediation is traceable and that the action is logged. Which approach should they take?

   • AUse Azure Policy with a 'Deny' effect to prevent the property from being set to true in the future, but do not remediate existing storage accounts.
   • BCreate a scheduled Azure Automation runbook that runs daily, checks all storage accounts, and sets the property to false if it is true.
   • CConfigure the CSPM webhook to trigger an Azure Logic App that sets 'allowBlobPublicAccess' to false and writes the action to a Log Analytics workspace.
   • DHave the CSPM tool send an email to the security team, who then manually changes the property in the Azure portal.
   Reveal Solution Discussion Select an answer first