What does 'policy drift' refer to in cloud security automation?

The process of automatically applying policies to new resources

The gradual divergence between the desired policy state and the actual configuration of cloud resources

The intentional updating of policies to meet new compliance requirements

The removal of outdated policies from the environment

A security team needs to automate auditing of their AWS environment against the NIST 800-53 framework. They want to generate compliance reports and receive alerts when resources fall out of compliance. Which AWS service should they use?

AWS CloudTrail to audit API activity for NIST 800-53 compliance.

AWS Trusted Advisor to check for NIST 800-53 compliance.

AWS Config with conformance packs that include NIST 800-53 controls.

AWS Inspector to scan for NIST 800-53 compliance.

Which statement best describes the core benefit of implementing security policies as code?

Policies are expressed in a declarative language and stored in version control, enabling automated enforcement and review.

Policies are written in natural language and interpreted by a human at deployment time.

Policies are stored in a human-readable document that is manually reviewed by security teams.

Policies are embedded directly into the application code and compiled with the application.

A company uses AWS Organizations and wants to enforce a policy that prevents the creation of EC2 instances without a specific tag. They want the policy to apply to all accounts in the organization, including future accounts. Which enforcement point should they use?

Configure a CloudTrail event that triggers a Lambda function to stop non-compliant instances.

Attach a service control policy (SCP) to the organization root that denies EC2 instance creation without the required tag.

Create an IAM policy in each account that denies EC2 instance creation without the tag.

Use AWS Config rules in each account to detect and terminate non-compliant instances.

GIAC Cloud Security Automation

Domain 2Objective 3

Policy Enforcement GCSA Practice Questions (Page 3)

Part of the Cloud Security Automation and Compliance domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

6concepts

Questions 11–15

11foundation · easy
What does 'policy drift' refer to in cloud security automation?
Select an answer first
12application · medium
A security team needs to automate auditing of their AWS environment against the NIST 800-53 framework. They want to generate compliance reports and receive alerts when resources fall out of compliance. Which AWS service should they use?
Select an answer first
13foundation · easy
Which cloud service is commonly used as a policy enforcement point for applying compliance policies to Azure resources?
Select an answer first
14foundation · easy
Which statement best describes the core benefit of implementing security policies as code?
Select an answer first
15application · medium
A company uses AWS Organizations and wants to enforce a policy that prevents the creation of EC2 instances without a specific tag. They want the policy to apply to all accounts in the organization, including future accounts. Which enforcement point should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.