A financial services firm is evaluating a cloud provider for a new customer-facing application. The provider offers a shared multi-tenant environment, but the firm's compliance team requires that customer data be stored in a specific geographic region and that the firm retain the ability to audit the provider's security controls. Which combination of actions best addresses the firm's requirements?

Require the provider to sign a business associate agreement and rely on that for compliance.

Encrypt all data at rest and in transit to eliminate the need for regional residency.

Select a provider region that matches the required data residency and request the provider's SOC 2 report and audit rights in the contract.

Use a private cloud deployment to ensure the provider cannot access the data.

A company's cloud environment has experienced a suspected data breach. The incident response team needs to preserve evidence while minimizing the impact on production systems. The cloud provider offers snapshot capabilities for virtual machines. What should the incident response team do first?

Delete the affected virtual machines to contain the breach

Take forensic snapshots of the affected virtual machines' disks

Immediately shut down all affected virtual machines to prevent further data loss

Notify law enforcement before taking any action

In the shared responsibility model for cloud computing, which party is typically responsible for securing the physical data center and underlying hardware?

Both the provider and customer equally

A company is negotiating a contract with a cloud service provider. The company handles personal data of EU citizens and must ensure that data transfers outside the EU comply with GDPR. The provider offers data centers in the EU and in other regions. What should the company include in the contract?

A clause requiring the provider to store and process all personal data only within the EU

A clause allowing the provider to transfer data anywhere as long as it is encrypted

A clause that the provider will delete all data after the contract ends

A clause that the provider will notify the company of any data breach within 72 hours

What does the term 'data residency' refer to in cloud compliance?

The legal ownership of data stored in the cloud

The encryption algorithm used to protect data

The process of deleting data after a retention period

The geographic location where a cloud provider stores and processes data

GIAC Security Leadership

Domain 2Objective 3

Managing Cloud Security GSLC Practice Questions (Page 2)

Part of the Technical Security Management domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~19–32 in this domain), expect 4–6 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

7concepts

Questions 6–10

6application · medium
A financial services firm is evaluating a cloud provider for a new customer-facing application. The provider offers a shared multi-tenant environment, but the firm's compliance team requires that customer data be stored in a specific geographic region and that the firm retain the ability to audit the provider's security controls. Which combination of actions best addresses the firm's requirements?
Select an answer first
7application · medium
A company's cloud environment has experienced a suspected data breach. The incident response team needs to preserve evidence while minimizing the impact on production systems. The cloud provider offers snapshot capabilities for virtual machines. What should the incident response team do first?
Select an answer first
8foundation · easy
In the shared responsibility model for cloud computing, which party is typically responsible for securing the physical data center and underlying hardware?
Select an answer first
9application · medium
A company is negotiating a contract with a cloud service provider. The company handles personal data of EU citizens and must ensure that data transfers outside the EU comply with GDPR. The provider offers data centers in the EU and in other regions. What should the company include in the contract?
Select an answer first
10foundation · easy
What does the term 'data residency' refer to in cloud compliance?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.