A large enterprise is adopting policy-as-code for their multi-cloud environment (AWS, Azure, GCP). They want to enforce a consistent set of security policies across all clouds, but each cloud has its own native policy engine. They also want to version, review, and test policies in a single repository. Which approach best balances consistency and maintainability?

Use cloud-specific tools like AWS Config, Azure Policy, and GCP Org Policy, and accept the inconsistency.

Use a cross-cloud policy-as-code tool like HashiCorp Sentinel or Open Policy Agent (OPA) that can evaluate policies across clouds.

Maintain separate policy repositories for each cloud and use native policy engines.

Use a single policy written in JSON that is manually translated to each cloud's native format.

A company uses Terraform to manage infrastructure. They have a policy that all resources must have a 'cost-center' tag. They notice that some resources are being created without the tag because developers are using the AWS console. They want to enforce the policy without blocking developers' ability to create resources. What is the best approach?

Use AWS Config with a managed rule that detects untagged resources and triggers a remediation action to add the tag.

Use a CloudTrail event that triggers a Lambda function to terminate untagged resources.

Require developers to use a Terraform wrapper script that automatically adds the tag.

Use a service control policy (SCP) that denies the creation of resources without the tag.

GIAC Cloud Security Automation

Domain 2Objective 3

Policy Enforcement GCSA Practice Questions (Page 8)

Part of the Cloud Security Automation and Compliance domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

6concepts

Questions 36–40

36expert · hard
A large enterprise is adopting policy-as-code for their multi-cloud environment (AWS, Azure, GCP). They want to enforce a consistent set of security policies across all clouds, but each cloud has its own native policy engine. They also want to version, review, and test policies in a single repository. Which approach best balances consistency and maintainability?
Select an answer first
37application · medium
A DevOps team wants to validate their Kubernetes manifests against the company's internal security policies, which are based on the CIS Kubernetes Benchmark. They want to integrate this validation into their CI/CD pipeline. Which tool should they use?
Select an answer first
38foundation · easy
Which compliance framework is specifically focused on cloud security best practices?
Select an answer first
39expert · medium
A company uses Terraform to manage infrastructure. They have a policy that all resources must have a 'cost-center' tag. They notice that some resources are being created without the tag because developers are using the AWS console. They want to enforce the policy without blocking developers' ability to create resources. What is the best approach?
Select an answer first
40application · medium
An organization uses Azure Policy to enforce tagging on all resources. They want to ensure that any resource created without the required 'CostCenter' tag is not created. Which Azure Policy effect should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.

Policy Enforcement GCSA Practice Questions (Page 8)

Questions 36–40

A DevOps team wants to validate their Kubernetes manifests against the company's internal security policies, which are based on the CIS Kubernetes Benchmark. They want to integrate this validation into their CI/CD pipeline. Which tool should they use?

Which compliance framework is specifically focused on cloud security best practices?

An organization uses Azure Policy to enforce tagging on all resources. They want to ensure that any resource created without the required 'CostCenter' tag is not created. Which Azure Policy effect should they use?

Keep studying — Cloud Security Automation and Compliance