A company uses Terraform to manage its infrastructure. The security team needs to audit who made changes to the infrastructure and when. They also need to be able to trace a specific change back to the code that caused it. What should they implement?

Use Terraform's `-auto-approve` flag to speed up deployments.

Store Terraform state in a remote backend and enable versioning on the state file.

Integrate Terraform with a CI/CD pipeline that logs the user, the commit hash, and the output of `terraform plan` and `terraform apply`.

Enable CloudTrail in AWS to log all API calls.

Which of the following is a trade-off of using imperative Infrastructure as Code?

It requires more detailed knowledge of the underlying infrastructure and ordering.

It is harder to predict the exact outcome because the tool decides the steps.

It cannot be used with configuration management tools.

It is less flexible for complex provisioning tasks.

An administrator notices that a security group in AWS was manually modified, and the Terraform state no longer matches the actual infrastructure. They want to restore the desired configuration. What is the appropriate action?

Run `terraform destroy` and recreate the resource

Run `terraform refresh` to update the state

Run `terraform plan` and then `terraform apply`

Manually edit the Terraform state file

A company uses Terraform to manage its infrastructure. They have a policy that all changes must go through the CI/CD pipeline. However, a developer manually changed a resource in the cloud console to fix an urgent issue. The next `terraform plan` will detect this drift and revert the change. The team wants to keep the manual change but also maintain the IaC as the source of truth. What is the best way to handle this?

Use `terraform apply -refresh-only` to update the state to match the actual resources.

Use `terraform import` to bring the resource into state without changing the code.

Use `terraform state rm` to remove the resource from state and then import it back after updating the code.

Update the Terraform code to reflect the manual change and then run `terraform plan` to ensure no drift.

How can compliance checks be integrated into Infrastructure as Code deployments?

By avoiding the use of any third-party tools.

By only checking compliance after the infrastructure is deployed.

By manually reviewing every template after deployment.

By using policy-as-code tools to automatically validate templates against compliance rules.

GIAC Cloud Security Automation

Domain 1Objective 3

Deploying Cloud Infrastructure as Code GCSA Practice Questions (Page 7)

Part of the DevOps and Cloud Infrastructure domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–19 in this domain), expect 3–5 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

10concepts

Questions 31–35

31application · medium
A company uses Terraform to manage its infrastructure. The security team needs to audit who made changes to the infrastructure and when. They also need to be able to trace a specific change back to the code that caused it. What should they implement?
Select an answer first
32foundation · easy
Which of the following is a trade-off of using imperative Infrastructure as Code?
Select an answer first
33application · medium
An administrator notices that a security group in AWS was manually modified, and the Terraform state no longer matches the actual infrastructure. They want to restore the desired configuration. What is the appropriate action?
Select an answer first
34expert · hard
A company uses Terraform to manage its infrastructure. They have a policy that all changes must go through the CI/CD pipeline. However, a developer manually changed a resource in the cloud console to fix an urgent issue. The next `terraform plan` will detect this drift and revert the change. The team wants to keep the manual change but also maintain the IaC as the source of truth. What is the best way to handle this?
Select an answer first
35foundation · easy
How can compliance checks be integrated into Infrastructure as Code deployments?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.