A large enterprise is adopting a multi-cloud strategy with AWS and Azure. They need to establish a centralized networking hub for all cloud traffic, enforce consistent security policies, and allow spokes to be added without affecting existing workloads. Which architecture pattern should they use?

Separate landing zones for each cloud provider with no interconnectivity.

Use a single cloud provider to avoid multi-cloud complexity.

Full mesh network topology between all VNets/VPCs.

Hub-and-spoke network topology with a transit VNet/VPC and centralized firewall.

A company runs a public-facing web application in the cloud. They are experiencing frequent DDoS attacks and SQL injection attempts. They want to use cloud-native services to mitigate these threats without changing the application code. Which combination of services should they use?

Use a network ACL to block all inbound traffic except from known IPs.

Use a cloud WAF and enable DDoS protection on the load balancer.

Deploy a VPN and require all users to connect through it.

Use a cloud firewall to filter traffic based on source IP.

Which security responsibility typically remains with the customer in a SaaS model?

Configuring the network firewalls

Managing user access and data classification

Physical security of data centers

Patching the underlying operating system

A company is using AWS and wants to protect their web application from DDoS attacks and also filter out malicious requests at the edge. Which services should they use?

AWS Shield Advanced and AWS WAF.

AWS Shield Standard and AWS Inspector.

AWS Firewall Manager and AWS Config.

AWS WAF and AWS Network Firewall.

GIAC Defensible Security Architect

Domain 5Objective 1

Cloud-Based Security Architecture GDSA Practice Questions (Page 11)

Part of the Cloud Security Architecture domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 5–8 from this objective — we provide 62 practice questions to prepare you well beyond it. (estimate)

62questions here

13free pages

14concepts

Questions 51–55

51application · medium
A company is running a serverless application on AWS Lambda. They want to ensure that the function code has no known vulnerabilities and that the runtime is up to date. Which service should they use?
Select an answer first
52expert · hard
A large enterprise is adopting a multi-cloud strategy with AWS and Azure. They need to establish a centralized networking hub for all cloud traffic, enforce consistent security policies, and allow spokes to be added without affecting existing workloads. Which architecture pattern should they use?
Select an answer first
53expert · hard
A company runs a public-facing web application in the cloud. They are experiencing frequent DDoS attacks and SQL injection attempts. They want to use cloud-native services to mitigate these threats without changing the application code. Which combination of services should they use?
Select an answer first
54foundation · easy
Which security responsibility typically remains with the customer in a SaaS model?
Select an answer first
55application · medium
A company is using AWS and wants to protect their web application from DDoS attacks and also filter out malicious requests at the edge. Which services should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDSA” is a trademark of its owner, used for identification only.