What does it mean for an Infrastructure as Code tool to be idempotent?

It requires a specific order of execution to work correctly.

It only works with declarative configuration languages.

It can run the same configuration multiple times without changing the result after the first run.

It always creates new resources on every run.

A company is developing Terraform modules for their infrastructure. They want to catch errors early in the development cycle, before any resources are created. Which testing approach should they implement in their CI pipeline?

Run `terraform plan` against a live AWS account

Deploy to production and monitor for issues

Use `terraform validate` and `terraform fmt` in the pipeline

A company runs a critical application in production. They use Terraform to manage the infrastructure. They need to deploy a new version of the application that requires a change to the database schema. The change is backward-incompatible. They want to minimize downtime and be able to roll back quickly if the deployment fails. Which strategy should they use?

Recreate deployment where all instances are terminated and new ones are created.

Blue-green deployment with the database change applied to the green environment, and a rollback plan that includes reverting the database schema.

Canary deployment where the new version is rolled out to a small percentage of users and monitored.

Rolling deployment with the database change applied incrementally to each instance.

What is a key characteristic of a blue-green deployment strategy?

It updates resources in place without any downtime.

It maintains two identical environments, one active and one idle, and switches traffic after validation.

It gradually shifts traffic from the old version to the new version over time.

It only works with containerized applications.

A team is evaluating IaC tools and needs to manage a complex, stateful infrastructure. They want the tool to automatically determine what changes are needed to reach the desired state, rather than specifying the exact steps. Which approach should they choose?

Declarative with AWS CLI commands

Imperative with Ansible playbooks

GIAC Cloud Security Automation

Domain 1Objective 3

Deploying Cloud Infrastructure as Code GCSA Practice Questions (Page 4)

Part of the DevOps and Cloud Infrastructure domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–19 in this domain), expect 3–5 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

10concepts

Questions 16–20

16foundation · easy
What does it mean for an Infrastructure as Code tool to be idempotent?
Select an answer first
17application · medium
A company is developing Terraform modules for their infrastructure. They want to catch errors early in the development cycle, before any resources are created. Which testing approach should they implement in their CI pipeline?
Select an answer first
18expert · hard
A company runs a critical application in production. They use Terraform to manage the infrastructure. They need to deploy a new version of the application that requires a change to the database schema. The change is backward-incompatible. They want to minimize downtime and be able to roll back quickly if the deployment fails. Which strategy should they use?
Select an answer first
19foundation · easy
What is a key characteristic of a blue-green deployment strategy?
Select an answer first
20application · medium
A team is evaluating IaC tools and needs to manage a complex, stateful infrastructure. They want the tool to automatically determine what changes are needed to reach the desired state, rather than specifying the exact steps. Which approach should they choose?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.