A company has a cloud environment and wants to detect and respond to security incidents. They need to collect logs from various cloud services, correlate them, and trigger automated responses. Which approach should they use?

Store logs in each service's native logging console and review them manually.

Use a CSPM tool to scan for misconfigurations and fix them automatically.

Deploy a network IDS in each VPC and alert on suspicious traffic.

Enable logging on all services and send logs to a central SIEM, then create alert rules that trigger automated playbooks.

A company is designing a multi-tier application in AWS. The web tier must be accessible from the internet, while the application and database tiers must be private. They also need to ensure that the database tier can only be accessed by the application tier. Which architecture should they use?

Use a public subnet for the web tier and private subnets for application and database tiers, with security groups allowing only required traffic.

Use a single private subnet for all tiers and rely on an internet gateway for web access.

Place all tiers in the same public subnet and use security group rules to restrict traffic.

Place the database in a separate VPC and peer it with the application VPC.

A company wants to implement single sign-on (SSO) for all their cloud applications. They currently use an on-premises identity provider. They also want to enforce MFA for all users. Which configuration should they use?

Use a cloud directory and manually create user accounts for each application.

Create separate accounts in each cloud application and use the same password.

Federate the on-premises identity provider with a cloud identity provider and enable MFA on the cloud identity provider.

Use a VPN to access all cloud applications and rely on the VPN for authentication.

Which statement best describes the shared responsibility model in cloud security?

Security responsibilities are split between the provider and customer, with the split varying by service model.

The customer is responsible for securing the physical infrastructure and hypervisor.

The provider and customer each have identical security responsibilities regardless of the service model.

The cloud provider is responsible for securing everything, including customer data and applications.

GIAC Defensible Security Architect

Domain 5Objective 1

Cloud-Based Security Architecture GDSA Practice Questions (Page 7)

Part of the Cloud Security Architecture domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 5–8 from this objective — we provide 62 practice questions to prepare you well beyond it. (estimate)

62questions here

13free pages

14concepts

Questions 31–35

31application · medium
A company has a cloud environment and wants to detect and respond to security incidents. They need to collect logs from various cloud services, correlate them, and trigger automated responses. Which approach should they use?
Select an answer first
32application · medium
A company is designing a multi-tier application in AWS. The web tier must be accessible from the internet, while the application and database tiers must be private. They also need to ensure that the database tier can only be accessed by the application tier. Which architecture should they use?
Select an answer first
33application · medium
A company wants to implement single sign-on (SSO) for all their cloud applications. They currently use an on-premises identity provider. They also want to enforce MFA for all users. Which configuration should they use?
Select an answer first
34foundation · easy
Which security architecture pattern assumes that no user or device is trusted by default, even if they are inside the network perimeter?
Select an answer first
35foundation · easy
Which statement best describes the shared responsibility model in cloud security?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDSA” is a trademark of its owner, used for identification only.