Which practice best describes immutable infrastructure?

Manually patching servers on a regular schedule

Replacing servers with new instances built from a golden image instead of modifying existing ones

Using snapshots to roll back changes on existing servers

Applying configuration updates to running servers using configuration management tools

A software company has a CI/CD pipeline that deploys applications to multiple cloud environments. The pipeline needs to authenticate to various cloud APIs and databases. The security team is concerned about hardcoded credentials in the pipeline configuration. Which solution should they implement?

Use the same service account credentials for all environments to simplify management.

Embed the credentials in the pipeline configuration file and restrict access to the repository.

Store all credentials in a central secrets vault and have the pipeline retrieve them dynamically at runtime using short-lived tokens.

Have developers manually enter credentials into the pipeline when a deployment is triggered.

What is a key security best practice when writing Infrastructure as Code (IaC) templates?

Use the same credentials for all environments to simplify management

Grant broad permissions to all resources to avoid deployment failures

Avoid hardcoding secrets and use parameterized values or references to a secrets vault

Disable logging for IaC deployments to reduce noise

Which of the following is a best practice for securing container images?

Store images in a public registry to allow community review

Scan images for vulnerabilities before pushing them to a registry

Use the latest tag for all images to ensure up-to-date software

Run containers with root privileges to avoid permission issues

Why should IaC templates be validated before deployment?

To ensure that the templates are written in the latest programming language

To catch misconfigurations and security issues before they are applied to the environment

To automatically generate documentation for the infrastructure

To reduce the size of the templates for faster deployment

GIAC Cloud Security Automation

Domain 1Objective 2

Securing the DevOps Workflow GCSA Practice Questions (Page 9)

Part of the DevOps and Cloud Infrastructure domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–19 in this domain), expect 3–5 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

10concepts

Questions 41–45

41foundation · easy
Which practice best describes immutable infrastructure?
Select an answer first
42application · medium
A software company has a CI/CD pipeline that deploys applications to multiple cloud environments. The pipeline needs to authenticate to various cloud APIs and databases. The security team is concerned about hardcoded credentials in the pipeline configuration. Which solution should they implement?
Select an answer first
43foundation · easy
What is a key security best practice when writing Infrastructure as Code (IaC) templates?
Select an answer first
44foundation · easy
Which of the following is a best practice for securing container images?
Select an answer first
45foundation · easy
Why should IaC templates be validated before deployment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.