A security team needs to map their internal policies to multiple compliance frameworks (CIS, NIST, PCI-DSS) for automated auditing. They want to avoid maintaining separate policy sets for each framework. Which approach should they take?

Create a single set of policies that are mapped to multiple frameworks using tags or metadata.

Use a spreadsheet to map each policy to each framework.

Use a third-party tool that automatically maps policies to frameworks.

Create separate policies for each framework to ensure full coverage.

A team maintains a policy-as-code repository. They want to introduce a new policy that will be enforced across all environments. What is the recommended sequence for deploying this policy?

Deploy directly to production and rely on the policy engine to catch any issues.

Create the policy but do not enforce it until the next quarterly review.

Test the policy in a sandbox environment, then deploy to production, and monitor for violations.

Write the policy, get approval, and then deploy it to all environments at once.

A security engineer notices that a cloud resource has been manually modified in the console, deviating from the configuration defined in the infrastructure-as-code repository. They want to detect and correct this drift automatically. Which approach should they use?

Use a configuration management tool like Ansible to enforce the desired state on the resource.

Set up a periodic pipeline that runs 'terraform plan' and compares the output to the committed state, then applies the changes if drift is detected.

Disable the console access to prevent manual modifications.

Manually compare the resource configuration to the code and update the code if needed.

Why is it important to regularly review and update policies as part of lifecycle management?

To ensure policies remain effective and aligned with evolving security threats and compliance requirements

To increase the number of policies in the environment

To reduce the need for automated enforcement

To simplify the policy language used

A security team has a policy-as-code repository with multiple policies. They want to ensure that policies are not accidentally retired while still being referenced by compliance frameworks. What should they implement?

A policy that requires two approvals for any policy deletion.

A regular backup of the policy repository.

A notification to the security team when a policy is deleted.

A policy dependency check that prevents deletion of policies that are mapped to compliance controls.

GIAC Cloud Security Automation

Domain 2Objective 3

Policy Enforcement GCSA Practice Questions (Page 1)

Part of the Cloud Security Automation and Compliance domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

6concepts

Questions 1–5

1expert · hard
A security team needs to map their internal policies to multiple compliance frameworks (CIS, NIST, PCI-DSS) for automated auditing. They want to avoid maintaining separate policy sets for each framework. Which approach should they take?
Select an answer first
2application · medium
A team maintains a policy-as-code repository. They want to introduce a new policy that will be enforced across all environments. What is the recommended sequence for deploying this policy?
Select an answer first
3application · medium
A security engineer notices that a cloud resource has been manually modified in the console, deviating from the configuration defined in the infrastructure-as-code repository. They want to detect and correct this drift automatically. Which approach should they use?
Select an answer first
4foundation · easy
Why is it important to regularly review and update policies as part of lifecycle management?
Select an answer first
5application · medium
A security team has a policy-as-code repository with multiple policies. They want to ensure that policies are not accidentally retired while still being referenced by compliance frameworks. What should they implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.