A company is designing a landing zone for a multi-account cloud environment. They need to enforce consistent security policies across all accounts, including network segmentation and IAM restrictions. They also want to allow individual teams to manage their own workloads without granting them access to the central security controls. Which pattern should they use?

Use a hub-and-spoke network topology with centralized security services in the hub, and apply service control policies at the organization level.

Create a separate VPC for each team and allow them to configure their own security groups.

Use a single account for all teams and rely on IAM roles to separate access.

Peer all VPCs directly and use network ACLs to enforce segmentation.

A company has a multi-account cloud environment and wants to continuously monitor for misconfigurations such as publicly accessible storage buckets and overly permissive security groups. They also want to receive alerts when new misconfigurations are detected. Which solution should they use?

Configure a web application firewall in front of all services.

Use a network intrusion detection system in each VPC.

Deploy a cloud security posture management (CSPM) tool that scans all accounts and integrates with their alerting system.

Enable CloudTrail and manually review logs weekly.

A company uses a multi-account AWS environment. The security team wants to continuously detect misconfigurations, such as S3 buckets with public access, and automatically remediate them. Which service should they use?

AWS Inspector with network assessments.

AWS CloudTrail with metric filters and CloudWatch alarms.

AWS Config with conformance packs and remediation actions.

AWS Trusted Advisor with weekly email notifications.

A company is setting up a new cloud environment and wants to establish a secure baseline that includes network segmentation, centralized logging, and IAM policies. They plan to expand to multiple accounts in the future. Which pattern should they use?

A set of IAM policies applied to each account individually.

A single VPC with all resources and no additional controls.

A landing zone with pre-configured network, logging, and IAM controls.

A hub-and-spoke network without centralized logging.

GIAC Defensible Security Architect

Domain 5Objective 1

Cloud-Based Security Architecture GDSA Practice Questions (Page 9)

Part of the Cloud Security Architecture domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 5–8 from this objective — we provide 62 practice questions to prepare you well beyond it. (estimate)

62questions here

13free pages

14concepts

Questions 41–45

41foundation · easy
Which security control is specifically designed to detect and respond to threats at runtime in a cloud workload?
Select an answer first
42expert · hard
A company is designing a landing zone for a multi-account cloud environment. They need to enforce consistent security policies across all accounts, including network segmentation and IAM restrictions. They also want to allow individual teams to manage their own workloads without granting them access to the central security controls. Which pattern should they use?
Select an answer first
43application · medium
A company has a multi-account cloud environment and wants to continuously monitor for misconfigurations such as publicly accessible storage buckets and overly permissive security groups. They also want to receive alerts when new misconfigurations are detected. Which solution should they use?
Select an answer first
44application · medium
A company uses a multi-account AWS environment. The security team wants to continuously detect misconfigurations, such as S3 buckets with public access, and automatically remediate them. Which service should they use?
Select an answer first
45application · medium
A company is setting up a new cloud environment and wants to establish a secure baseline that includes network segmentation, centralized logging, and IAM policies. They plan to expand to multiple accounts in the future. Which pattern should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDSA” is a trademark of its owner, used for identification only.

Cloud-Based Security Architecture GDSA Practice Questions (Page 9)

Questions 41–45

Which security control is specifically designed to detect and respond to threats at runtime in a cloud workload?

A company has a multi-account cloud environment and wants to continuously monitor for misconfigurations such as publicly accessible storage buckets and overly permissive security groups. They also want to receive alerts when new misconfigurations are detected. Which solution should they use?

A company uses a multi-account AWS environment. The security team wants to continuously detect misconfigurations, such as S3 buckets with public access, and automatically remediate them. Which service should they use?

A company is setting up a new cloud environment and wants to establish a secure baseline that includes network segmentation, centralized logging, and IAM policies. They plan to expand to multiple accounts in the future. Which pattern should they use?

Keep studying — Cloud Security Architecture