Automated Cloud Remediation GCSA Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A cloud security team wants to automatically respond to a specific finding from their CSPM tool: an S3 bucket that becomes publicly readable. They want the remediation to occur within seconds of the change, and they need a full audit trail of the action. Which event-driven design best meets these requirements?

   • AHave the CSPM tool send a webhook to a SIEM, which then creates a ticket for a human analyst to review and fix the bucket policy.
   • BRun a scheduled Lambda function every 15 minutes that checks all S3 buckets for public access and removes any public policies it finds.
   • CConfigure the CSPM tool to publish a finding to an SNS topic, which triggers a Lambda function that removes the public access block and logs the action to CloudTrail.
   • DUse AWS EventBridge to detect the 'PutBucketPolicy' API call, invoke a Lambda function that evaluates the new policy and, if it allows public access, replaces it with a private policy and logs the change to CloudTrail.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A security operations team is creating a playbook to respond to a specific security finding: an AWS security group that allows SSH access from 0.0.0.0/0. The playbook should remove the overly permissive rule. What is the most important consideration when designing this playbook?

   • AEnsure the playbook terminates all EC2 instances associated with the security group.
   • BEnsure the playbook deletes the entire security group.
   • CEnsure the playbook sends an email to the security team for manual review.
   • DEnsure the playbook only removes the specific rule that matches the finding, not all rules in the security group.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A company uses AWS CloudFormation to manage its infrastructure. A security review finds that a resource was manually modified outside of CloudFormation, causing drift. The team wants to remediate the drift and ensure that the resource is brought back to the state defined in the template. Which action should they take?

   • ARun 'aws cloudformation detect-stack-drift' to identify the drift, then run 'aws cloudformation update-stack' with the original template to restore the resource.
   • BUpdate the CloudFormation template to match the manual change, then run 'update-stack'.
   • CDelete the CloudFormation stack and recreate it from the template.
   • DUse the AWS CLI to manually change the resource back to the desired state.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A startup is adopting automated remediation for the first time. The security lead wants to start with a small set of low-risk, high-frequency issues to build confidence. Which issue is the best candidate for initial automated remediation?

   • AAn S3 bucket that is accidentally made public, where the remediation is to remove the public access block.
   • BA virtual machine that is running an outdated operating system, where the remediation is to automatically reboot the VM to apply updates.
   • CA production database that has a misconfigured backup retention period, where the remediation is to change the retention policy.
   • DAn IAM role that has excessive permissions, where the remediation is to remove the permissions automatically.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A security team has created an automated remediation playbook that terminates EC2 instances that are flagged as compromised. Before deploying this playbook to production, what should the team do to ensure the playbook is safe and effective?

   • AReview the playbook code and confirm it matches the security policy.
   • BCreate a report of the playbook's expected actions and share it with management.
   • CRun the playbook on a single production instance to see if it works.
   • DTest the playbook in a staging environment with simulated instances and verify that only the intended instances are terminated.
   Reveal Solution Discussion Select an answer first