A company uses Ansible to manage configuration of their servers. They want to detect when a server's configuration drifts from the playbook and automatically correct it. Which approaches will achieve this? (Select all that apply.)

Run ansible-playbook with --check mode on a schedule and alert on changes.

Use ansible-pull with a cron job to fetch and apply the playbook from a Git repo.

Run ansible-playbook on a schedule to enforce the desired state.

Use Ansible Tower's job templates with a survey to manually run the playbook.

A DevOps team uses Ansible to configure servers. They need to validate that the configuration management code complies with internal security policies before it is applied to production. What is the best way to automate this validation?

Run a policy-as-code scan on the Ansible playbooks in the CI pipeline before deployment.

Deploy to production and use an agent to check for compliance after the fact.

Apply the playbooks to a test environment and then manually review the resulting configuration.

Use Ansible's built-in syntax check to validate the playbook syntax.

A company must comply with NIST 800-53 controls. They have implemented policy-as-code to enforce security configurations. How can they automate the auditing of these controls?

Conduct an annual manual audit of all policies against NIST controls.

Use a spreadsheet to track which policies map to which NIST controls.

Rely on the cloud provider's compliance certifications to cover NIST requirements.

Map each policy to the corresponding NIST control IDs and generate compliance reports from the policy engine.

GIAC Cloud Security Automation

Domain 2Objective 3

Policy Enforcement GCSA Practice Questions (Page 6)

Part of the Cloud Security Automation and Compliance domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

6concepts

Questions 26–30

26application · medium · select all that apply
A company uses Ansible to manage configuration of their servers. They want to detect when a server's configuration drifts from the playbook and automatically correct it. Which approaches will achieve this? (Select all that apply.)
Select an answer first
27application · medium
A DevOps team uses Ansible to configure servers. They need to validate that the configuration management code complies with internal security policies before it is applied to production. What is the best way to automate this validation?
Select an answer first
28foundation · easy
Which tool is commonly used for automated policy validation of infrastructure as code?
Select an answer first
29application · medium
A company must comply with NIST 800-53 controls. They have implemented policy-as-code to enforce security configurations. How can they automate the auditing of these controls?
Select an answer first
30application · medium
A company uses Azure Policy to enforce that all storage accounts have HTTPS-only traffic enabled. They want to automatically remediate any storage account that is created without this setting. Which Azure Policy effect should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.

Policy Enforcement GCSA Practice Questions (Page 6)

Questions 26–30

A company uses Ansible to manage configuration of their servers. They want to detect when a server's configuration drifts from the playbook and automatically correct it. Which approaches will achieve this? (Select all that apply.)

A DevOps team uses Ansible to configure servers. They need to validate that the configuration management code complies with internal security policies before it is applied to production. What is the best way to automate this validation?

Which tool is commonly used for automated policy validation of infrastructure as code?

A company must comply with NIST 800-53 controls. They have implemented policy-as-code to enforce security configurations. How can they automate the auditing of these controls?

A company uses Azure Policy to enforce that all storage accounts have HTTPS-only traffic enabled. They want to automatically remediate any storage account that is created without this setting. Which Azure Policy effect should they use?

Keep studying — Cloud Security Automation and Compliance