Automated Cloud Remediation GCSA Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A security team is designing a remediation workflow for a finding that indicates an AWS S3 bucket has been made public. The workflow must automatically make the bucket private, but the team is concerned about breaking legitimate public access (e.g., a static website). What is the best way to handle this trade-off?

   • ASend an alert to the security team and let them decide whether to make the bucket private.
   • BMake the bucket private automatically, and if the website breaks, the team will fix it later.
   • CCreate a separate bucket for the public website and move the content there.
   • DUse a tag on the bucket to indicate that public access is allowed, and have the remediation workflow skip buckets with that tag.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is a common method for validating an automated remediation action?

   • ARunning the remediation in a sandbox or test environment that mirrors production
   • BReviewing the remediation code only once, without executing it
   • CAsking a colleague to manually perform the same steps
   • DExecuting the remediation directly in production without prior testing
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Why are reports on remediation activities important for compliance?

   • AThey automatically enforce security policies
   • BThey provide evidence that security issues were detected and corrected in a timely manner
   • CThey replace the need for external security audits
   • DThey are only required for organizations that have experienced a breach
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   In the context of cloud security automation, what does automated remediation primarily help an organization achieve?

   • AFaster response to security findings and reduced manual effort
   • BComplete removal of the need for security monitoring
   • CElimination of all security risks in the cloud environment
   • DGuaranteed compliance with all regulatory standards
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company wants to automate the remediation of public-facing storage buckets that are accidentally made public. The security team needs to know which buckets were remediated and when, for audit purposes. Which design best satisfies the requirement?

   • ACreate a policy-as-code rule that prevents buckets from being created as public, but does not address existing buckets.
   • BSend an alert to the security team when a bucket becomes public and let them fix it manually.
   • CUse a scheduled job that scans for public buckets and makes them private, but does not log the changes.
   • DTrigger a function on bucket policy changes that makes the bucket private and logs the event to an audit log.
   Reveal Solution Discussion Select an answer first