A security team wants to get a unified view of security posture across their AWS and Azure environments, including compliance with CIS benchmarks. Which tool should they use?

A third-party CSPM tool that supports multi-cloud.

Azure Sentinel with AWS CloudTrail connector.

AWS Security Hub and Azure Security Center separately.

A team is deploying a Linux VM in Azure for a critical application. They need to ensure the VM is hardened against known vulnerabilities and that any new vulnerabilities are detected as soon as possible. Which Azure service should they use?

Azure Security Center with vulnerability assessment and just-in-time access.

Azure Firewall with threat intelligence-based filtering.

Azure Bastion for secure remote access.

Azure Policy with custom definitions.

A company uses Azure and wants to collect security logs from multiple sources, including Azure AD, Azure Platform, and Office 365, and then analyze them for threats. Which service should they use?

Azure Sentinel (Microsoft Sentinel).

Azure Log Analytics workspaces.

A healthcare organization is storing patient data in a public cloud object storage service. They must encrypt the data at rest and control the encryption keys to meet compliance requirements. They also need to be able to revoke access to the data immediately if a key is compromised. Which key management strategy should they use?

Use a cloud KMS with customer-managed keys and enable key rotation and revocation.

Use a hardware security module on-premises and export the keys to the cloud for encryption.

Use client-side encryption and store the keys in the same cloud account.

Use server-side encryption with cloud-provider-managed keys.

GIAC Defensible Security Architect

Domain 5Objective 1

Cloud-Based Security Architecture GDSA Practice Questions (Page 1)

Part of the Cloud Security Architecture domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 5–8 from this objective — we provide 62 practice questions to prepare you well beyond it. (estimate)

62questions here

13free pages

14concepts

Questions 1–5

1application · medium
A security team wants to get a unified view of security posture across their AWS and Azure environments, including compliance with CIS benchmarks. Which tool should they use?
Select an answer first
2application · medium
A team is deploying a Linux VM in Azure for a critical application. They need to ensure the VM is hardened against known vulnerabilities and that any new vulnerabilities are detected as soon as possible. Which Azure service should they use?
Select an answer first
3application · medium
A company uses Azure and wants to collect security logs from multiple sources, including Azure AD, Azure Platform, and Office 365, and then analyze them for threats. Which service should they use?
Select an answer first
4foundation · easy
Which compliance framework is specifically designed for organizations that handle credit card data?
Select an answer first
5application · medium
A healthcare organization is storing patient data in a public cloud object storage service. They must encrypt the data at rest and control the encryption keys to meet compliance requirements. They also need to be able to revoke access to the data immediately if a key is compromised. Which key management strategy should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDSA” is a trademark of its owner, used for identification only.

Cloud-Based Security Architecture GDSA Practice Questions (Page 1)

Questions 1–5

A security team wants to get a unified view of security posture across their AWS and Azure environments, including compliance with CIS benchmarks. Which tool should they use?

A team is deploying a Linux VM in Azure for a critical application. They need to ensure the VM is hardened against known vulnerabilities and that any new vulnerabilities are detected as soon as possible. Which Azure service should they use?

A company uses Azure and wants to collect security logs from multiple sources, including Azure AD, Azure Platform, and Office 365, and then analyze them for threats. Which service should they use?

Which compliance framework is specifically designed for organizations that handle credit card data?

Keep studying — Cloud Security Architecture