A security team is conducting a benchmark assessment of their Azure environment using the CIS Microsoft Azure Foundations Benchmark. They need to identify which of their Azure subscriptions are compliant with the benchmark's recommendations. Which tool should they use?

Azure Security Center (now Microsoft Defender for Cloud) with regulatory compliance policies.

Azure Resource Graph to query resource configurations.

Azure Monitor with custom log queries.

Azure Policy with custom definitions that match the CIS benchmark.

A company is subject to both GDPR and PCI-DSS. They are using a cloud provider to process personal data and payment card data. They have implemented CIS benchmarks and need to ensure compliance with both regulations. What is the most critical consideration?

Apply only the CIS benchmarks, as they cover all compliance requirements.

Use a single compliance framework that covers both regulations.

Ensure that data transfers outside the EU are compliant with GDPR, and that cardholder data is protected per PCI-DSS.

Keep all data within the EU to simplify compliance.

A company is integrating its on-premises network with a cloud provider using a dedicated connection (e.g., AWS Direct Connect or Azure ExpressRoute). The security team wants to ensure that traffic between the on-premises data center and the cloud VPC/VNet is encrypted. Which control should they implement?

Enable encryption over the dedicated connection using IPsec VPN.

Implement network access control lists (NACLs) on the cloud subnets.

Use a private VLAN on the dedicated connection.

Use a cloud VPN gateway over the public internet instead of the dedicated connection.

A security team is remediating findings from a CIS benchmark assessment in their GCP environment. One finding indicates that VMs are not using a customer-managed encryption key (CMEK). The team wants to remediate this without causing downtime. What should they do?

Use a third-party encryption tool on the existing VMs.

Create new VMs with CMEK-enabled disks and migrate the workloads.

Enable CMEK on the existing VMs by updating the disk encryption settings.

Ignore the finding because CMEK is not required by CIS.

A security team wants to use CIS benchmarks to assess the configuration of their cloud environment. What is the primary purpose of applying these benchmarks?

To provide a set of configuration guidelines that help secure systems and cloud services

To guarantee compliance with all regulatory requirements

To replace the need for vulnerability scanning

To automate the deployment of all cloud resources

GIAC Public Cloud Security

Domain 3Objective 1

Cloud Integration and Benchmarking GPCS Practice Questions (Page 3)

Part of the Network and Compliance Security domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 5–8 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

6concepts

Questions 11–15

11application · medium
A security team is conducting a benchmark assessment of their Azure environment using the CIS Microsoft Azure Foundations Benchmark. They need to identify which of their Azure subscriptions are compliant with the benchmark's recommendations. Which tool should they use?
Select an answer first
12expert · hard
A company is subject to both GDPR and PCI-DSS. They are using a cloud provider to process personal data and payment card data. They have implemented CIS benchmarks and need to ensure compliance with both regulations. What is the most critical consideration?
Select an answer first
13application · medium
A company is integrating its on-premises network with a cloud provider using a dedicated connection (e.g., AWS Direct Connect or Azure ExpressRoute). The security team wants to ensure that traffic between the on-premises data center and the cloud VPC/VNet is encrypted. Which control should they implement?
Select an answer first
14expert · hard
A security team is remediating findings from a CIS benchmark assessment in their GCP environment. One finding indicates that VMs are not using a customer-managed encryption key (CMEK). The team wants to remediate this without causing downtime. What should they do?
Select an answer first
15foundation · easy
A security team wants to use CIS benchmarks to assess the configuration of their cloud environment. What is the primary purpose of applying these benchmarks?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPCS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPCS” is a trademark of its owner, used for identification only.