A security team wants to automate the validation of their infrastructure-as-code templates against multiple compliance frameworks (CIS, NIST, PCI-DSS) in their CI/CD pipeline. They want to avoid slowing down the pipeline significantly. Which approach best balances thorough validation and pipeline speed?

Run separate tools for each framework sequentially.

Run a single static analysis tool that checks for all frameworks in parallel.

Use a manual review process for compliance validation.

Only run validation on production deployments, not on every commit.

What is the primary purpose of automated policy validation in a CI/CD pipeline?

To automatically check infrastructure code and deployments against defined policies before they are applied

To replace the need for security testing entirely

To manually review each deployment for compliance before release

To generate compliance reports for auditors after deployment

A company uses Azure Policy to enforce tagging on all resources. An administrator notices that some resources have missing or incorrect tags despite the policy being assigned. They need to identify and remediate these resources automatically. What should they do?

Run a PowerShell script manually to find and tag all resources that are missing tags.

Reassign the policy with the 'Audit' effect to see which resources are non-compliant.

Create an Azure Monitor alert that triggers when a resource is created without the required tags.

Use the Azure Policy 'DeployIfNotExists' effect with a remediation task to automatically apply the required tags.

An organization has a policy-as-code repository that has grown over time. Some policies are outdated, conflicting, or no longer align with the current security posture. The team wants to ensure policies remain effective and up-to-date. What should they do first?

Establish a policy review cadence and a deprecation process for retiring obsolete policies.

Delete all policies that have not been updated in the last six months.

Move all policies to a single file to simplify management.

Run a drift detection tool to identify resources that do not match the policies.

A security engineer is implementing automated validation of AWS CloudFormation templates against the company's CIS benchmarks before deployment. They want to integrate this into their CI/CD pipeline so that non-compliant templates fail the build. Which tool should they use?

AWS Security Hub to review the template for compliance.

AWS Config rules that evaluate deployed resources against CIS benchmarks.

cfn-lint to check the template syntax and resource properties.

Checkov or cfn-nag to scan the template for CIS benchmark violations.

GIAC Cloud Security Automation

Domain 2Objective 3

Policy Enforcement GCSA Practice Questions (Page 5)

Part of the Cloud Security Automation and Compliance domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

6concepts

Questions 21–25

21expert · hard
A security team wants to automate the validation of their infrastructure-as-code templates against multiple compliance frameworks (CIS, NIST, PCI-DSS) in their CI/CD pipeline. They want to avoid slowing down the pipeline significantly. Which approach best balances thorough validation and pipeline speed?
Select an answer first
22foundation · easy
What is the primary purpose of automated policy validation in a CI/CD pipeline?
Select an answer first
23application · medium
A company uses Azure Policy to enforce tagging on all resources. An administrator notices that some resources have missing or incorrect tags despite the policy being assigned. They need to identify and remediate these resources automatically. What should they do?
Select an answer first
24application · medium
An organization has a policy-as-code repository that has grown over time. Some policies are outdated, conflicting, or no longer align with the current security posture. The team wants to ensure policies remain effective and up-to-date. What should they do first?
Select an answer first
25application · medium
A security engineer is implementing automated validation of AWS CloudFormation templates against the company's CIS benchmarks before deployment. They want to integrate this into their CI/CD pipeline so that non-compliant templates fail the build. Which tool should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.