A security team wants to enforce that all Terraform templates for AWS deployments use encrypted EBS volumes and do not allow public S3 buckets. They want to check this automatically before any infrastructure is deployed. What is the most efficient way to achieve this?

Use Terraform's built-in `validate` command to check for security issues.

Use a policy-as-code tool like Sentinel or OPA to evaluate Terraform plans against the security policies.

Add manual review steps in the CI/CD pipeline for every Terraform change.

Configure AWS Config rules to detect non-compliant resources after they are deployed.

Which principle is central to the Infrastructure as Code (IaC) approach?

Infrastructure is provisioned only once and never modified after initial deployment.

Infrastructure changes must be applied manually by a system administrator to ensure accuracy.

Each environment must have a unique, hand-crafted configuration that is not shared.

Infrastructure configuration is stored in human-readable definition files that can be versioned and reviewed.

A company has a mix of on-premises servers and cloud resources. They want to use IaC to manage both. They also need to ensure that the configuration of the servers is idempotent. Which tool should they choose?

Azure Resource Manager (ARM) templates

An organization uses Terraform to manage its infrastructure. They have a policy that any manual change to infrastructure must be detected and remediated within 24 hours. They want to automate this process. What should they implement?

Use `terraform output` to compare with actual resources

Run `terraform refresh` nightly to update the state

Schedule a nightly job that runs `terraform plan` and, if drift is detected, automatically runs `terraform apply`

Manually review the AWS console every morning

GIAC Cloud Security Automation

Domain 1Objective 3

Deploying Cloud Infrastructure as Code GCSA Practice Questions (Page 3)

Part of the DevOps and Cloud Infrastructure domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–19 in this domain), expect 3–5 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

10concepts

Questions 11–15

11application · medium
A security team wants to enforce that all Terraform templates for AWS deployments use encrypted EBS volumes and do not allow public S3 buckets. They want to check this automatically before any infrastructure is deployed. What is the most efficient way to achieve this?
Select an answer first
12foundation · easy
Which principle is central to the Infrastructure as Code (IaC) approach?
Select an answer first
13expert · hard
A company has a mix of on-premises servers and cloud resources. They want to use IaC to manage both. They also need to ensure that the configuration of the servers is idempotent. Which tool should they choose?
Select an answer first
14expert · hard
An organization uses Terraform to manage its infrastructure. They have a policy that any manual change to infrastructure must be detected and remediated within 24 hours. They want to automate this process. What should they implement?
Select an answer first
15application · medium
An e-commerce company is deploying a new version of their web application to a Kubernetes cluster. They want to minimize downtime and be able to roll back quickly if the new version has issues. They also want to test the new version with a small percentage of real users before full rollout. Which deployment strategy should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.