An organization uses Terraform to deploy infrastructure and needs to maintain an audit trail of who made changes and when. They also want to be notified if a deployment fails. What should they configure?

Store Terraform state in a public S3 bucket

Enable verbose logging on the Terraform CLI

Use a CI/CD pipeline that logs all Terraform runs and sends alerts on failure

Use `terraform output` to display resource details

A DevOps team is building a CI/CD pipeline for Terraform. They want to ensure that the infrastructure changes are tested before deployment. They have a staging environment that mirrors production. What is the most effective way to test Terraform changes?

Use a static analysis tool like `checkov` to scan the Terraform code.

Use `terraform validate` and `terraform fmt` only.

Run `terraform apply` in the staging environment and then run integration tests against the deployed resources.

Run `terraform plan` in the staging environment and manually review the output.

What is a key characteristic of declarative Infrastructure as Code?

You must manually manage dependencies between resources.

You specify the exact commands to execute in order to achieve the desired state.

You define the desired end state, and the tool determines the steps to reach that state.

You write scripts that run in a specific order to provision resources.

What is the purpose of auditing Infrastructure as Code deployments?

To speed up the deployment process.

To automatically correct any configuration drift.

To ensure that deployments comply with organizational policies and regulatory requirements.

To eliminate the need for monitoring.

A DevOps team wants to integrate Terraform into their CI/CD pipeline. They want to automatically validate and test infrastructure changes before deploying to production. Which sequence of steps should they implement in the pipeline?

Use `terraform import` to bring existing resources under management

Run `terraform apply` directly in the pipeline without any validation

Run `terraform destroy` after every deployment to clean up

Run `terraform fmt`, `terraform validate`, and `terraform plan` in a CI job, then require manual approval before `terraform apply`

GIAC Cloud Security Automation

Domain 1Objective 3

Deploying Cloud Infrastructure as Code GCSA Practice Questions (Page 5)

Part of the DevOps and Cloud Infrastructure domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–19 in this domain), expect 3–5 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

10concepts

Questions 21–25

21application · medium
An organization uses Terraform to deploy infrastructure and needs to maintain an audit trail of who made changes and when. They also want to be notified if a deployment fails. What should they configure?
Select an answer first
22expert · hard
A DevOps team is building a CI/CD pipeline for Terraform. They want to ensure that the infrastructure changes are tested before deployment. They have a staging environment that mirrors production. What is the most effective way to test Terraform changes?
Select an answer first
23foundation · easy
What is a key characteristic of declarative Infrastructure as Code?
Select an answer first
24foundation · easy
What is the purpose of auditing Infrastructure as Code deployments?
Select an answer first
25application · medium
A DevOps team wants to integrate Terraform into their CI/CD pipeline. They want to automatically validate and test infrastructure changes before deploying to production. Which sequence of steps should they implement in the pipeline?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.