A financial services company is subject to PCI-DSS and is using a cloud provider to host its payment processing application. The company needs to ensure that its cloud configuration meets PCI-DSS requirements. Which approach should they take?

Implement all PCI-DSS controls on-premises and use the cloud only for non-sensitive data.

Use the cloud provider's compliance reports and map them to PCI-DSS controls.

Assume the cloud provider is responsible for all PCI-DSS compliance.

Use a third-party scanner to scan the cloud provider's infrastructure.

A company is integrating a cloud-based HR system with their on-premises Active Directory using federation. The HR system will store employee PII and must comply with GDPR. The security team is concerned about the federation endpoint being a single point of failure. What should they do?

Disable federation and use local accounts in the HR system.

Store the federation certificates on-premises only.

Use a shared secret instead of federation to authenticate the HR system.

Deploy a second federation endpoint in a different region for high availability.

A company is extending its on-premises data center to Azure using a site-to-site VPN. The security team requires that all administrative traffic to the Azure VMs be authenticated using the existing on-premises Active Directory, and that no new administrative accounts be created in Azure AD. The VMs are joined to the corporate domain. Which configuration should be used to meet the requirement?

Configure the VMs to use the on-premises domain controller as the DNS server and join them to the corporate domain.

Enable Azure AD Domain Services and sync on-premises users with Azure AD Connect.

Use Azure Bastion with password authentication against a local VM user database.

Create a new Azure AD tenant and federate it with the on-premises AD using AD FS.

A healthcare organization is moving patient data to a public cloud and must comply with HIPAA. They have implemented CIS benchmarks for their cloud VMs. What additional step is essential to ensure HIPAA compliance?

Sign a Business Associate Agreement (BAA) with the cloud provider and configure logging and access controls for ePHI.

Ensure all VMs are encrypted at rest and in transit.

Conduct a risk assessment and implement all CIS controls.

Apply the CIS benchmarks to all cloud services, not just VMs.

A security auditor is reviewing an AWS account that hosts a public-facing web application. The auditor wants to assess the configuration of the EC2 instances against a recognized industry standard. Which approach should the auditor take?

Use AWS Config rules that are mapped to the CIS AWS Foundations Benchmark.

Run AWS Inspector and review its findings against the CIS AWS Foundations Benchmark.

Enable AWS CloudTrail and analyze the logs for configuration changes.

Review the AWS Trusted Advisor security checks and compare them to the CIS benchmark.

GIAC Public Cloud Security

Domain 3Objective 1

Cloud Integration and Benchmarking GPCS Practice Questions (Page 7)

Part of the Network and Compliance Security domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 5–8 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

6concepts

Questions 31–35

31application · medium
A financial services company is subject to PCI-DSS and is using a cloud provider to host its payment processing application. The company needs to ensure that its cloud configuration meets PCI-DSS requirements. Which approach should they take?
Select an answer first
32expert · hard
A company is integrating a cloud-based HR system with their on-premises Active Directory using federation. The HR system will store employee PII and must comply with GDPR. The security team is concerned about the federation endpoint being a single point of failure. What should they do?
Select an answer first
33application · medium
A company is extending its on-premises data center to Azure using a site-to-site VPN. The security team requires that all administrative traffic to the Azure VMs be authenticated using the existing on-premises Active Directory, and that no new administrative accounts be created in Azure AD. The VMs are joined to the corporate domain. Which configuration should be used to meet the requirement?
Select an answer first
34application · medium
A healthcare organization is moving patient data to a public cloud and must comply with HIPAA. They have implemented CIS benchmarks for their cloud VMs. What additional step is essential to ensure HIPAA compliance?
Select an answer first
35application · medium
A security auditor is reviewing an AWS account that hosts a public-facing web application. The auditor wants to assess the configuration of the EC2 instances against a recognized industry standard. Which approach should the auditor take?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPCS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPCS” is a trademark of its owner, used for identification only.