Cloud Compliance as Code GCSA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In the context of compliance as code, what is the role of version control for compliance artifacts?

   • AIt ensures that compliance policies are stored in a central repository accessible only to auditors.
   • BIt allows compliance policies to be reviewed, changed, and rolled back with a complete history of who changed what and when.
   • CIt automatically generates compliance reports from the latest policy definitions.
   • DIt provides a backup of compliance documents in case of data loss.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An organization needs to provide evidence to an auditor that their Azure environment is compliant with the NIST SP 800-53 controls. They want to automate the collection of this evidence and generate a report that maps Azure resources to specific NIST controls. What should they use?

   • AAzure Security Center with the NIST SP 800-53 regulatory compliance dashboard.
   • BAzure Monitor with custom queries to check for compliance.
   • CAzure Blueprints with a NIST SP 800-53 sample blueprint.
   • DAzure Policy with a custom initiative that includes all NIST controls.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security team must continuously verify that all Azure VMs have disk encryption enabled and produce a monthly report of any non-compliant resources. Which combination of Azure services should they use?

   • AAzure Monitor with a custom alert rule that triggers when disk encryption is disabled, and email the alert to the compliance team.
   • BAzure Blueprints to assign the disk encryption policy and use Azure Service Health to track policy compliance.
   • CAzure Policy with a built-in audit policy for disk encryption, and Azure Resource Graph to query compliance details for the report.
   • DAzure Security Center's regulatory compliance dashboard and export the findings to a Log Analytics workspace.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company is using multiple cloud providers (AWS, Azure, and GCP). They need a single, unified view of their compliance posture across all clouds. They want to use a third-party tool to aggregate compliance data and generate reports. What is the most important feature to look for in this tool?

   • AThe ability to generate reports in a specific format (e.g., PDF, CSV).
   • BThe ability to write custom compliance policies in a single language.
   • CThe ability to connect to each cloud provider's native compliance services (e.g., AWS Config, Azure Policy, GCP Security Command Center).
   • DThe ability to automatically remediate non-compliant resources across all clouds.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An organization uses AWS Config to detect S3 buckets that lack versioning. They want to automatically enable versioning on non-compliant buckets without manual intervention. Which remediation approach should they implement?

   • ASet up an AWS Lambda function that is triggered by an Amazon EventBridge rule on AWS Config compliance change notifications.
   • BEnable AWS Trusted Advisor to automatically fix S3 bucket versioning settings.
   • CCreate an AWS Config remediation action using an SSM automation document that enables versioning on the bucket.
   • DUse AWS Systems Manager Patch Manager to apply the versioning configuration to all S3 buckets.
   Reveal Solution Discussion Select an answer first