A multinational company stores personal data of EU citizens in a public cloud. They want to ensure compliance with GDPR. Which action is most directly required?

Use a private cloud to ensure data never leaves the company's physical premises.

Encrypt all data with a key stored in the same cloud region.

Ensure the cloud region is located within the EU or that appropriate transfer mechanisms are in place.

Delete all personal data after one year regardless of legal requirements.

A city is deploying smart parking meters that connect to a central management system via public cellular networks. The meters collect payment data. Which security measure is ESSENTIAL to protect payment data in transit?

Disable remote management features

Use TLS or VPN tunnels for all communication between meters and the management system

Implement MAC address filtering on the cellular network

Use a proprietary communication protocol

A company operates in a country with strict data sovereignty laws. They want to use a cloud provider for processing but must ensure data does not leave the country. Which approach is most appropriate?

Use a cloud region located within the country and configure data residency policies.

Use encryption to protect data in transit and at rest.

Use a hybrid cloud with data stored on-premises and processing in the public cloud.

Use a private cloud hosted in a neighboring country.

A company stores sensitive data in a cloud database. They want to protect the data even if the database administrator's credentials are compromised. Which control is most effective?

Enable audit logging for all database queries.

Use column-level encryption so that sensitive fields are encrypted with keys not accessible to the database administrator.

Use strong passwords and MFA for the database administrator account.

Use network security groups to restrict database access to only the application server.

GIAC Information Security Fundamentals

Domain 2Objective 3

Securing Connected and Cloud-Based Environments GISF Practice Questions (Page 8)

Part of the Network and Systems Security domain, which makes up ~28% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~14–22 in this domain), expect 5–7 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

8concepts

Questions 36–40

36foundation · easy
Which of the following is a governance framework specifically designed to help organizations manage cloud computing risks and controls?
Select an answer first
37application · medium
A multinational company stores personal data of EU citizens in a public cloud. They want to ensure compliance with GDPR. Which action is most directly required?
Select an answer first
38application · medium
A city is deploying smart parking meters that connect to a central management system via public cellular networks. The meters collect payment data. Which security measure is ESSENTIAL to protect payment data in transit?
Select an answer first
39expert · hard
A company operates in a country with strict data sovereignty laws. They want to use a cloud provider for processing but must ensure data does not leave the country. Which approach is most appropriate?
Select an answer first
40expert · hard
A company stores sensitive data in a cloud database. They want to protect the data even if the database administrator's credentials are compromised. Which control is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISF” is a trademark of its owner, used for identification only.