A multi-national company must comply with data residency requirements that mandate all customer data be stored in a specific geographic region. They use a CI/CD pipeline to deploy infrastructure. Which approach should they use to enforce this policy?

Use a policy-as-code tool to validate that all storage resources in the infrastructure code specify the required region.

Use a cloud provider's built-in data residency feature to automatically move data to the required region.

Use a cloud provider's compliance report to identify non-compliant resources after deployment.

Require the security team to manually review all infrastructure changes for region compliance.

A company distributes a software product as a container image. Customers have reported that the image they pulled from a mirror registry differs from the official one. The company wants to allow customers to verify the integrity and origin of the image. Which control should the company implement?

Use a public registry and rely on its built-in scanning to ensure the image is safe.

Publish a SHA-256 checksum of the image on the company website.

Provide a link to the source code repository so customers can build the image themselves.

Sign the container image with a private key and publish the public key so customers can verify the signature.

A software company distributes a desktop application and wants to ensure that customers receive a genuine, unmodified product. They use a CI/CD pipeline to build and release the application. Which practice should they implement?

Sign the application binary with a code-signing certificate and publish the certificate's public key for verification.

Publish the source code so customers can build the application themselves.

Compress the application into a zip file and require a password to download it.

Use a checksum and publish it on the website for customers to compare.

An organization is migrating its production workloads to a cloud environment and wants to ensure that any change to the infrastructure is traceable and that servers are never manually modified. The operations team currently uses configuration management tools to apply updates. Which practice best meets the organization's requirement?

Allow administrators to SSH into servers for troubleshooting and apply hotfixes as needed.

Use a configuration management tool to apply patches directly to running servers and log all changes.

Use a configuration management tool to enforce the desired state on servers and re-run it periodically.

Deploy new server instances from a golden image for every change and decommission the old instances.

Why is continuous monitoring important in a DevOps environment?

It provides real-time visibility into system behavior and security events, enabling rapid detection and response

It automatically fixes all security vulnerabilities

It eliminates the need for incident response procedures

It replaces the need for security testing in the pipeline

GIAC Cloud Security Automation

Domain 1Objective 2

Securing the DevOps Workflow GCSA Practice Questions (Page 8)

Part of the DevOps and Cloud Infrastructure domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–19 in this domain), expect 3–5 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

10concepts

Questions 36–40

36expert · hard
A multi-national company must comply with data residency requirements that mandate all customer data be stored in a specific geographic region. They use a CI/CD pipeline to deploy infrastructure. Which approach should they use to enforce this policy?
Select an answer first
37application · medium
A company distributes a software product as a container image. Customers have reported that the image they pulled from a mirror registry differs from the official one. The company wants to allow customers to verify the integrity and origin of the image. Which control should the company implement?
Select an answer first
38application · medium
A software company distributes a desktop application and wants to ensure that customers receive a genuine, unmodified product. They use a CI/CD pipeline to build and release the application. Which practice should they implement?
Select an answer first
39application · medium
An organization is migrating its production workloads to a cloud environment and wants to ensure that any change to the infrastructure is traceable and that servers are never manually modified. The operations team currently uses configuration management tools to apply updates. Which practice best meets the organization's requirement?
Select an answer first
40foundation · easy
Why is continuous monitoring important in a DevOps environment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.