Why should vulnerability scanning of dependencies be part of the CI/CD pipeline for serverless functions?

To ensure that only dependencies without known vulnerabilities are deployed

To automatically fix all vulnerabilities without human review

To increase the function's concurrency limit

To reduce the function's cold start time

What is the purpose of data minimization in serverless functions?

To collect and process only the data necessary for the function's intended purpose

To ensure the function runs faster by using less data

To encrypt all data in transit and at rest

To store all data in a single location for easier access

A company suspects that a malicious actor exploited a vulnerability in a Google Cloud Function. The function is stateless and uses Cloud Storage for input and output. The incident response team needs to collect forensic evidence. What should they do first?

Immediately delete the function and recreate it from the latest source code to stop the attack.

Take a snapshot of the function's runtime memory using a debugger attached to the live instance.

Enable Cloud Audit Logs for the function and Cloud Storage, and capture the function's logs, environment configuration, and IAM policy bindings before making any changes.

Change the function's IAM role to deny all access and then review the logs later.

A security team is investigating a potential compromise of an AWS Lambda function. They suspect that the function's IAM role was used to access an S3 bucket that it should not have had access to. The team has CloudTrail enabled, but they are not sure if the relevant events were captured. What should they check first?

Use AWS Config to see the historical IAM policy attached to the role.

Review the S3 bucket's access logs, which are enabled by default.

Check the Lambda function's CloudWatch logs for any S3 access messages.

Verify that CloudTrail is logging data events for the S3 bucket and that the trail is logging the Lambda function's execution role.

GIAC Public Cloud Security

Domain 2Objective 5

Securing Serverless Functions GPCS Practice Questions (Page 2)

Part of the Cloud Platform and Service Security domain, which makes up ~60% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~30–48 in this domain), expect 6–10 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

12concepts

Questions 6–10

6foundation · easy
Why should vulnerability scanning of dependencies be part of the CI/CD pipeline for serverless functions?
Select an answer first
7foundation · easy
What is the purpose of data minimization in serverless functions?
Select an answer first
8application · medium
A company suspects that a malicious actor exploited a vulnerability in a Google Cloud Function. The function is stateless and uses Cloud Storage for input and output. The incident response team needs to collect forensic evidence. What should they do first?
Select an answer first
9expert · hard
A security team is investigating a potential compromise of an AWS Lambda function. They suspect that the function's IAM role was used to access an S3 bucket that it should not have had access to. The team has CloudTrail enabled, but they are not sure if the relevant events were captured. What should they check first?
Select an answer first
10foundation · easy
Which control is specifically designed to protect a serverless function from being overwhelmed by a sudden spike in invocations?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPCS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPCS” is a trademark of its owner, used for identification only.

Securing Serverless Functions GPCS Practice Questions (Page 2)

Questions 6–10

Why should vulnerability scanning of dependencies be part of the CI/CD pipeline for serverless functions?

What is the purpose of data minimization in serverless functions?

A company suspects that a malicious actor exploited a vulnerability in a Google Cloud Function. The function is stateless and uses Cloud Storage for input and output. The incident response team needs to collect forensic evidence. What should they do first?

Which control is specifically designed to protect a serverless function from being overwhelmed by a sudden spike in invocations?

Keep studying — Cloud Platform and Service Security