A company is deploying a microservices application on AWS ECS. They want to isolate traffic between services and enforce least privilege at the network level. Which approach should they use?

Use a single security group for all services.

Use network ACLs with broad allow rules.

Use security groups for each service and reference other security groups in rules.

Use AWS PrivateLink for all inter-service communication.

A company is moving a custom application to a cloud PaaS offering. They want to reduce their security management burden. Which security responsibility is most likely still the customer's?

Securing the physical data center.

Configuring the network infrastructure.

Managing the application code and its configuration.

Patching the underlying operating system.

A company is designing a zero-trust network architecture in the cloud. They want to enforce least privilege and micro-segmentation for their workloads. They also need to support dynamic workloads that scale up and down. Which approach should they use?

Use a service mesh that provides identity-based micro-segmentation and policy enforcement.

Use a traditional perimeter firewall to segment the network.

Use network security groups that are updated manually as workloads change.

Place all workloads in a single subnet and rely on host-based firewalls.

A company is deploying a multi-tier application in a public cloud IaaS environment. The web tier must be accessible from the internet, but the application and database tiers must not be directly reachable from the internet. They also need to ensure that the web tier can only communicate with the application tier on a specific port. Which architecture should they use?

Use separate subnets for each tier, apply network security groups to restrict traffic, and use a public IP only on the web tier.

Place all tiers in the same subnet and rely on host-based firewalls on each VM.

Put the database tier in a different VPC and peer it with the application tier.

Place all tiers in a single subnet and use a load balancer to expose only the web tier.

Which cloud-native service is specifically designed to absorb and mitigate large-scale distributed denial-of-service (DDoS) attacks?

Cloud access security broker (CASB)

DDoS protection service (e.g., AWS Shield, Azure DDoS Protection)

Security information and event management (SIEM)

GIAC Defensible Security Architect

Domain 5Objective 1

Cloud-Based Security Architecture GDSA Practice Questions (Page 12)

Part of the Cloud Security Architecture domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 5–8 from this objective — we provide 62 practice questions to prepare you well beyond it. (estimate)

62questions here

13free pages

14concepts

Questions 56–60

56application · medium
A company is deploying a microservices application on AWS ECS. They want to isolate traffic between services and enforce least privilege at the network level. Which approach should they use?
Select an answer first
57application · medium
A company is moving a custom application to a cloud PaaS offering. They want to reduce their security management burden. Which security responsibility is most likely still the customer's?
Select an answer first
58expert · hard
A company is designing a zero-trust network architecture in the cloud. They want to enforce least privilege and micro-segmentation for their workloads. They also need to support dynamic workloads that scale up and down. Which approach should they use?
Select an answer first
59application · medium
A company is deploying a multi-tier application in a public cloud IaaS environment. The web tier must be accessible from the internet, but the application and database tiers must not be directly reachable from the internet. They also need to ensure that the web tier can only communicate with the application tier on a specific port. Which architecture should they use?
Select an answer first
60foundation · easy
Which cloud-native service is specifically designed to absorb and mitigate large-scale distributed denial-of-service (DDoS) attacks?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDSA” is a trademark of its owner, used for identification only.