A company uses multiple AWS accounts and wants to centralize compliance monitoring. They need to detect S3 buckets with public access across all accounts and generate a consolidated report. Which architecture should they use?

Run a script in each account that checks S3 bucket policies and sends the results to a central S3 bucket.

Use AWS Trusted Advisor to check S3 bucket permissions and email the report to the security team.

Use AWS Organizations to apply a Service Control Policy that denies public S3 buckets.

Enable AWS Config in each account and aggregate the results into a central account using AWS Config Aggregators.

What is a common change management practice for compliance policies stored as code?

Directly committing changes to the main branch without review.

Deleting old policy versions to reduce clutter.

Requiring peer review and approval before merging changes.

Storing policies outside of version control to avoid complexity.

A security team manages a repository of OPA policies that enforce compliance rules across multiple cloud environments. They need to ensure that any change to these policies is reviewed and approved before it is used in the CI/CD pipeline. What is the best practice to implement this?

Require a pull request with at least one approval from a senior security engineer and use branch protection rules to prevent direct pushes to the main branch.

Store the policies in a shared drive and have the CI/CD pipeline pull the latest version.

Allow all developers to push directly to the main branch and rely on automated tests to catch issues.

Use a separate repository for policies and sync it to the main repository using a cron job.

Which of the following is an example of a compliance check that can be performed on an IaC template?

Analyzing application performance metrics.

Reviewing user login logs for unauthorized access.

Monitoring network traffic for anomalies.

Verifying that an S3 bucket policy allows public access.

GIAC Cloud Security Automation

Domain 2Objective 2

Cloud Compliance as Code GCSA Practice Questions (Page 2)

Part of the Cloud Security Automation and Compliance domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

10concepts

Questions 6–10

6expert · hard
A company uses multiple AWS accounts and wants to centralize compliance monitoring. They need to detect S3 buckets with public access across all accounts and generate a consolidated report. Which architecture should they use?
Select an answer first
7foundation · easy
What is a common change management practice for compliance policies stored as code?
Select an answer first
8application · medium
A security team manages a repository of OPA policies that enforce compliance rules across multiple cloud environments. They need to ensure that any change to these policies is reviewed and approved before it is used in the CI/CD pipeline. What is the best practice to implement this?
Select an answer first
9expert · hard
A security team needs to provide auditors with evidence that their AWS environment continuously meets PCI DSS requirements. They want to automate the collection of evidence and generate a report that maps controls to specific resources. Which AWS service should they use?
Select an answer first
10foundation · easy
Which of the following is an example of a compliance check that can be performed on an IaC template?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.