A company runs a legacy application service that uses an outdated runtime version. The security team wants to reduce the risk of known vulnerabilities while minimizing downtime. The application cannot be modified to use a newer runtime. What should the security team do?

Disable the application service until the application is rewritten.

Enable the application service's diagnostic logs and monitor for attacks.

Apply virtual patches through a web application firewall and restrict access to the application service to trusted networks.

Upgrade the runtime to the latest version, even though the application may break.

A company's application service must communicate with an on-premises database over a private connection. The company wants to avoid exposing the database to the internet. What should the company implement?

Expose the database to the internet with a firewall rule that allows only the application service's public IP address.

Use a site-to-site VPN or ExpressRoute to connect the cloud virtual network to the on-premises network, and use private IP addresses for the database.

Create a network security group that allows the application service's outbound traffic to the database's public IP address.

Use the application service's public endpoint to connect to the database over the internet.

Which practice best implements least privilege for a cloud application service that needs to read from a storage bucket?

Grant the service full administrative access to the storage account

Grant the service a role that allows only read access to the specific bucket

Assign a broad role that allows read and write to all storage buckets

Use the root account credentials of the cloud account

In the shared responsibility model for a cloud application service platform such as a managed web app service, which security control is typically the responsibility of the cloud customer?

Managing the physical security of the data centers hosting the platform

Patching the underlying operating system of the platform

Configuring application-level authentication and authorization

Replacing failed hardware in the platform's hosting infrastructure

Which control is specifically designed to prevent sensitive data from being exfiltrated from a cloud application service?

Security information and event management (SIEM)

Virtual private network (VPN) gateway

Data loss prevention (DLP) policies

GIAC Public Cloud Security

Domain 2Objective 3

Securing Cloud Application Service Platforms GPCS Practice Questions (Page 2)

Part of the Cloud Platform and Service Security domain, which makes up ~60% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~30–48 in this domain), expect 6–10 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

7concepts

Questions 6–10

6application · medium
A company runs a legacy application service that uses an outdated runtime version. The security team wants to reduce the risk of known vulnerabilities while minimizing downtime. The application cannot be modified to use a newer runtime. What should the security team do?
Select an answer first
7application · medium
A company's application service must communicate with an on-premises database over a private connection. The company wants to avoid exposing the database to the internet. What should the company implement?
Select an answer first
8foundation · easy
Which practice best implements least privilege for a cloud application service that needs to read from a storage bucket?
Select an answer first
9foundation · easy
In the shared responsibility model for a cloud application service platform such as a managed web app service, which security control is typically the responsibility of the cloud customer?
Select an answer first
10foundation · easy
Which control is specifically designed to prevent sensitive data from being exfiltrated from a cloud application service?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPCS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPCS” is a trademark of its owner, used for identification only.