What is the purpose of cloud provider-native compliance services (e.g., AWS Config, Azure Policy)?

To provide a single dashboard for all cloud providers.

To replace the need for any third-party security tools.

To automate compliance assessment and reporting for resources within that cloud.

To automatically remediate all compliance violations without configuration.

A team is using a CI/CD pipeline to deploy a microservices application to Kubernetes. They have a requirement to test the deployed application for compliance with internal security policies, such as ensuring that no service is exposed with a NodePort. They are considering using OPA Gatekeeper as an admission controller. What is the primary advantage of using OPA Gatekeeper for this requirement?

It can generate a compliance report for auditors.

It can validate Kubernetes manifests before they are deployed by running as a CI job.

It can automatically remediate non-compliant resources by deleting them.

It can enforce policies in real-time at the point of resource creation, preventing non-compliant resources from being created in the cluster.

A company is required to maintain continuous compliance with the PCI DSS standard. They are using AWS and need to demonstrate that they are continuously monitoring their environment. They have a requirement to generate a report that shows the compliance status of all resources at any given time. What is the most effective way to meet this requirement?

Use AWS CloudTrail to log all API calls and manually review them for compliance.

Use AWS Security Hub to aggregate findings and generate a compliance report.

Use AWS Audit Manager to continuously collect evidence and generate reports that map to PCI DSS controls.

Use AWS Config to record configuration changes and generate a report on-demand.

A security team maintains a repository of compliance policies as code. They want to ensure that any change to a policy is tested against a set of sample resources before it is merged. Which approach should they use?

Use a separate repository for testing and merge changes manually.

Require a manual code review before merging, but do not run tests.

Run the tests only after merging to the main branch.

Add a CI job that runs the policy tests on every pull request and requires the tests to pass before merging.

How can cloud provider APIs be used to support compliance automation?

By manually exporting data to spreadsheets for review.

By programmatically retrieving resource configurations and compliance status.

By automatically fixing all compliance issues without any configuration.

By providing a graphical interface for compliance checks.

GIAC Cloud Security Automation

Domain 2Objective 2

Cloud Compliance as Code GCSA Practice Questions (Page 4)

Part of the Cloud Security Automation and Compliance domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

10concepts

Questions 16–20

16foundation · easy
What is the purpose of cloud provider-native compliance services (e.g., AWS Config, Azure Policy)?
Select an answer first
17expert · hard
A team is using a CI/CD pipeline to deploy a microservices application to Kubernetes. They have a requirement to test the deployed application for compliance with internal security policies, such as ensuring that no service is exposed with a NodePort. They are considering using OPA Gatekeeper as an admission controller. What is the primary advantage of using OPA Gatekeeper for this requirement?
Select an answer first
18expert · hard
A company is required to maintain continuous compliance with the PCI DSS standard. They are using AWS and need to demonstrate that they are continuously monitoring their environment. They have a requirement to generate a report that shows the compliance status of all resources at any given time. What is the most effective way to meet this requirement?
Select an answer first
19expert · hard
A security team maintains a repository of compliance policies as code. They want to ensure that any change to a policy is tested against a set of sample resources before it is merged. Which approach should they use?
Select an answer first
20foundation · easy
How can cloud provider APIs be used to support compliance automation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.

Cloud Compliance as Code GCSA Practice Questions (Page 4)

Questions 16–20

What is the purpose of cloud provider-native compliance services (e.g., AWS Config, Azure Policy)?

A security team maintains a repository of compliance policies as code. They want to ensure that any change to a policy is tested against a set of sample resources before it is merged. Which approach should they use?

How can cloud provider APIs be used to support compliance automation?

Keep studying — Cloud Security Automation and Compliance