A developer is designing a serverless function that is triggered by an HTTP request. The function needs to maintain a counter of how many times it has been called. The developer is considering storing the counter in a global variable inside the function. Why is this approach problematic?

Using a global variable would cause a denial-of-service vulnerability.

Serverless functions are stateless; the execution environment may be reused across invocations, so the counter may not be reliable or consistent.

The counter would be reset every time the function is invoked, so it would always be 1.

Global variables are not supported in serverless functions.

A team manages a portfolio of serverless functions. A new critical vulnerability is disclosed in a common runtime library used by several functions. What is the first step in the vulnerability management process?

Disable all functions that use the library until a patch is available.

Identify all functions that use the affected library and assess their exposure to the vulnerability.

Wait for the library maintainers to release a patch and then apply it.

Immediately update all functions to the latest version of the library without testing.

A company uses a CI/CD pipeline to deploy Google Cloud Functions. The security team wants to ensure that no function is deployed with known critical vulnerabilities in its dependencies. What is the most effective control to add to the pipeline?

Require a manual approval step before every deployment to production.

Enable automatic updates for all dependencies in the function's runtime environment.

Run a software composition analysis (SCA) tool that fails the build if critical vulnerabilities are found.

Use a source code scanner that only checks for hardcoded secrets.

Which factor should be considered when prioritizing which vulnerability to remediate first in a serverless function?

The severity of the vulnerability and the function's exposure to untrusted input

The developer's personal preference

The color of the function's icon in the console

What is the purpose of implementing rate limiting on a serverless function?

To allow unlimited invocations for all users

To limit the number of invocations a client can make within a time period, preventing abuse and denial of service

To increase the function's memory allocation

To encrypt the function's output

GIAC Public Cloud Security

Domain 2Objective 5

Securing Serverless Functions GPCS Practice Questions (Page 3)

Part of the Cloud Platform and Service Security domain, which makes up ~60% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~30–48 in this domain), expect 6–10 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

12concepts

Questions 11–15

11application · medium
A developer is designing a serverless function that is triggered by an HTTP request. The function needs to maintain a counter of how many times it has been called. The developer is considering storing the counter in a global variable inside the function. Why is this approach problematic?
Select an answer first
12application · medium
A team manages a portfolio of serverless functions. A new critical vulnerability is disclosed in a common runtime library used by several functions. What is the first step in the vulnerability management process?
Select an answer first
13application · medium
A company uses a CI/CD pipeline to deploy Google Cloud Functions. The security team wants to ensure that no function is deployed with known critical vulnerabilities in its dependencies. What is the most effective control to add to the pipeline?
Select an answer first
14foundation · easy
Which factor should be considered when prioritizing which vulnerability to remediate first in a serverless function?
Select an answer first
15foundation · easy
What is the purpose of implementing rate limiting on a serverless function?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPCS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPCS” is a trademark of its owner, used for identification only.