Automated Cloud Remediation GCSA Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A security engineer is configuring automated remediation for a public cloud environment. The team wants to automatically revoke overly permissive security group rules as soon as they are created. The engineer has a Cloud Security Posture Management (CSPM) tool that can emit a real-time event when a new security group rule is detected. Which approach best meets the requirement?

   • ACreate a playbook that a security analyst manually runs when they receive an alert about a new security group rule.
   • BUse a policy-as-code tool that evaluates the infrastructure-as-code template before deployment and blocks the rule from being created.
   • CConfigure the CSPM tool to send an event to a serverless function that evaluates the rule and, if it is overly permissive, removes it.
   • DSchedule a nightly script that scans all security group rules and removes any that are overly permissive.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A security team has implemented automated remediation for several security findings. The compliance team needs to provide evidence that remediation actions are working. What should the team implement to meet this requirement?

   • AA notification to the security team when a remediation action fails.
   • BA dashboard that shows the number of findings detected, remediated, and failed, with a detailed log of each action.
   • CA shared spreadsheet where analysts manually record remediation actions.
   • DA weekly email summary of all security findings.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A security team has implemented automated remediation for a set of security findings. The compliance team wants to provide auditors with a report that shows the number of findings, the remediation actions taken, and the success rate. Which reporting approach should the team use?

   • ASend an email to the compliance team each time a remediation action is taken.
   • BGenerate a weekly report from the remediation logs that includes the number of findings, actions taken, and success rate.
   • CCreate a dashboard that shows the current number of open findings and the number of remediated findings, but do not retain historical data.
   • DProvide auditors with read-only access to the raw remediation logs.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A company uses Terraform with OPA policies to enforce security standards. The security team wants to automatically remediate any drift from the policy baseline. However, the team is concerned that automatic remediation could override manual changes made by developers for legitimate reasons. Which approach best balances policy enforcement with developer flexibility?

   • AUse OPA only in the CI/CD pipeline, and do not apply it to manual changes made directly in the cloud console.
   • BUse OPA to allow non-compliant plans if the developer adds a 'policy-exception' tag with a justification, and use a separate process to review exceptions and remediate if not approved.
   • CAutomatically apply the OPA policy to all Terraform plans and revert any manual changes that do not match the policy.
   • DUse OPA to block any Terraform plan that does not comply with the policy, and require developers to fix the code before merging.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A company uses HashiCorp Sentinel to enforce policies on Terraform plans. The security team wants to automatically remediate any infrastructure that is deployed without the required encryption settings. The team uses a GitOps workflow where all changes are merged to a main branch. Which approach should they take to enforce the policy and remediate non-compliant resources?

   • AConfigure Sentinel to block non-compliant Terraform plans and rely on developers to fix the code before merging.
   • BEnable AWS Config managed rule 'encrypted-volumes' and set the action to auto-remediate by attaching a new encrypted volume to the instance.
   • CUse a CI/CD pipeline that runs Sentinel checks on pull requests, and if a plan fails, automatically apply a Terraform module that adds the required encryption settings to the resource configuration.
   • DCreate a Lambda function that periodically scans all AWS resources and uses the AWS SDK to enable encryption on any resource that lacks it.
   Reveal Solution Discussion Select an answer first