A company is using a cloud provider's IaaS to host a web server. The security team must ensure that the web server's data is encrypted both at rest and in transit. The provider offers managed encryption keys, but the company's compliance policy requires the company to control the encryption keys. Which approach satisfies both requirements?

Use customer-managed keys for storage encryption and TLS for data in transit

Encrypt data in the application layer and use provider-managed keys for storage

Use TLS for data in transit and store data without encryption

Use provider-managed keys for storage encryption and rely on the provider's network security

A system administrator is planning to consolidate multiple physical servers into a single host using virtualization. They need to ensure that a compromise of one VM does not affect other VMs on the same host. Which control is most important to implement?

Disable memory overcommitment to improve performance

Use the same virtual switch for all VMs to simplify management

Enable hypervisor-level isolation and keep the hypervisor patched

Store all VM snapshots on a shared network share

A security administrator manages a VMware vSphere cluster hosting multiple production VMs. During a routine audit, they discover that a VM snapshot created three months ago contains a domain admin credential hash. The snapshot is still stored on the same datastore as the active VMs. Which action best reduces the risk posed by this snapshot?

Move the snapshot to a separate datastore with restricted access.

Convert the snapshot into a full clone of the VM.

Encrypt the snapshot using vSphere encryption.

Delete the snapshot after confirming the VM is stable and no rollback is needed.

A hospital chain must store electronic health records (EHR) and requires that the data remain within a specific country due to national data residency laws. They also want to benefit from cloud scalability during peak periods. Which deployment model best satisfies both requirements?

Community cloud shared with other hospitals

Private cloud hosted on-premises

Hybrid cloud with public cloud in another country

Public cloud with a region located in the required country

A company deploys an image recognition model for security cameras. An attacker wants to fool the model into misclassifying a person as a tree by adding imperceptible noise to the image. Which defensive technique is most directly effective against this attack?

Adversarial training that includes perturbed images in the training set

Logging all inference requests for audit

Encrypting the model weights at rest

Restricting API access to authenticated users only

GIAC Security Essentials

Domain 6Objective 3

Virtualization, Cloud Security, and AI Essentials GSEC Practice Questions (Page 10)

Part of the Data Protection and Emerging Technologies domain, which makes up ~12% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~11–19 in this domain), expect 4–6 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

10concepts

Questions 46–50

46expert · medium
A company is using a cloud provider's IaaS to host a web server. The security team must ensure that the web server's data is encrypted both at rest and in transit. The provider offers managed encryption keys, but the company's compliance policy requires the company to control the encryption keys. Which approach satisfies both requirements?
Select an answer first
47application · medium
A system administrator is planning to consolidate multiple physical servers into a single host using virtualization. They need to ensure that a compromise of one VM does not affect other VMs on the same host. Which control is most important to implement?
Select an answer first
48application · medium
A security administrator manages a VMware vSphere cluster hosting multiple production VMs. During a routine audit, they discover that a VM snapshot created three months ago contains a domain admin credential hash. The snapshot is still stored on the same datastore as the active VMs. Which action best reduces the risk posed by this snapshot?
Select an answer first
49application · medium
A hospital chain must store electronic health records (EHR) and requires that the data remain within a specific country due to national data residency laws. They also want to benefit from cloud scalability during peak periods. Which deployment model best satisfies both requirements?
Select an answer first
50application · medium
A company deploys an image recognition model for security cameras. An attacker wants to fool the model into misclassifying a person as a tree by adding imperceptible noise to the image. Which defensive technique is most directly effective against this attack?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.

Virtualization, Cloud Security, and AI Essentials GSEC Practice Questions (Page 10)

Questions 46–50

A system administrator is planning to consolidate multiple physical servers into a single host using virtualization. They need to ensure that a compromise of one VM does not affect other VMs on the same host. Which control is most important to implement?

A hospital chain must store electronic health records (EHR) and requires that the data remain within a specific country due to national data residency laws. They also want to benefit from cloud scalability during peak periods. Which deployment model best satisfies both requirements?

A company deploys an image recognition model for security cameras. An attacker wants to fool the model into misclassifying a person as a tree by adding imperceptible noise to the image. Which defensive technique is most directly effective against this attack?

Keep studying — Data Protection and Emerging Technologies