Which of the following is an example of using policy-as-code to enforce compliance?

Manually reviewing each cloud resource after deployment to check for compliance

Sending email reminders to administrators to check compliance monthly

Using a spreadsheet to track which resources are compliant

Writing a rule that denies the creation of storage buckets without encryption enabled

A financial services company must comply with a regulation that requires all storage buckets to be encrypted and access to be logged. They use a CI/CD pipeline to deploy infrastructure. How should they enforce this policy?

Set up a scheduled job that scans the cloud environment and alerts if any bucket is unencrypted or lacks logging.

Implement a policy-as-code check in the pipeline that validates the infrastructure code for encryption and logging settings before deployment.

Use a cloud provider's built-in compliance report to check for non-compliant resources after deployment.

Create a checklist for engineers to manually verify encryption and logging settings before they merge code.

A development team uses a CI/CD pipeline that builds a container image, runs unit tests, and deploys to a staging environment. The security team wants to automatically block deployment if the image contains a critical vulnerability. The pipeline already has access to a container registry and a secrets vault. Which approach should the security team implement?

Use the secrets vault to store the scanner's API key and have the pipeline run the scan only on the final production image after release.

Add a pipeline stage that runs a container image scanner against the built image and fails the build if a critical vulnerability is found, using credentials from the vault.

Configure the container registry to automatically delete any image tagged as 'latest' if a vulnerability is found after deployment.

Require developers to manually run a vulnerability scanner on their local machines before pushing code to the repository.

A company uses a CI/CD pipeline to build and deploy a containerized application. They want to ensure that the container image used in production is exactly the same as the one that was tested and approved. Which practice should they implement?

Use a signed image and verify the signature at deployment time.

Rely on the CI/CD pipeline to build the image and push it to the registry, assuming it is the same image.

Use a tag like 'latest' in the deployment manifest to always pull the most recent image.

Use a content-addressable registry that stores images by their digest and reference the digest in the deployment manifest.

What is the purpose of signing container images?

To verify the integrity and origin of the image

To compress the image for faster download

To make the image publicly accessible

To automatically update the image when vulnerabilities are found

GIAC Cloud Security Automation

Domain 1Objective 2

Securing the DevOps Workflow GCSA Practice Questions (Page 1)

Part of the DevOps and Cloud Infrastructure domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–19 in this domain), expect 3–5 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

10concepts

Questions 1–5

1foundation · easy
Which of the following is an example of using policy-as-code to enforce compliance?
Select an answer first
2application · medium
A financial services company must comply with a regulation that requires all storage buckets to be encrypted and access to be logged. They use a CI/CD pipeline to deploy infrastructure. How should they enforce this policy?
Select an answer first
3application · medium
A development team uses a CI/CD pipeline that builds a container image, runs unit tests, and deploys to a staging environment. The security team wants to automatically block deployment if the image contains a critical vulnerability. The pipeline already has access to a container registry and a secrets vault. Which approach should the security team implement?
Select an answer first
4expert · hard
A company uses a CI/CD pipeline to build and deploy a containerized application. They want to ensure that the container image used in production is exactly the same as the one that was tested and approved. Which practice should they implement?
Select an answer first
5foundation · easy
What is the purpose of signing container images?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.