A company experiences a security incident in its cloud environment. The incident response team needs to preserve evidence while minimizing the impact on production systems. Which action should the team take first?

Shut down the affected virtual machines immediately.

Delete the affected virtual machines to prevent further spread.

Notify the cloud provider and request a full account suspension.

Snapshot the affected virtual machines and storage volumes.

A company's cloud environment has been compromised, and the incident response team needs to contain the breach. The compromised resource is a virtual machine that is part of a production application. The team wants to isolate the VM without losing the ability to analyze it later. What should the team do?

Power off the VM and leave it in the same network

Detach the VM's network interface and move it to an isolated security group

Take a snapshot of the VM and then restore it to a clean state

Delete the VM immediately to stop the attack

A multinational corporation is moving HR data to a cloud provider. The legal team notes that the data is subject to the EU General Data Protection Regulation (GDPR). The provider offers data centers in the EU, the US, and Asia. What is the most important contractual requirement to include in the cloud agreement?

A requirement that all data be encrypted with a specific algorithm.

A clause that the provider will delete all data after one year.

A commitment that the provider will not store data in Asia.

A data processing agreement (DPA) that includes standard contractual clauses for international data transfers.

When a cloud customer processes personal data of EU residents, which legal framework imposes obligations on the customer as a data controller?

Health Insurance Portability and Accountability Act (HIPAA)

General Data Protection Regulation (GDPR)

Payment Card Industry Data Security Standard (PCI DSS)

A company's cloud environment has been compromised. The incident response team needs to determine the scope of the breach, but the cloud provider's logging is not enabled. What should the team do first?

Enable logging and monitoring for the affected resources and begin collecting data.

Contact law enforcement before taking any action.

Immediately disconnect all affected resources from the network.

Restore the affected systems from backups.

GIAC Security Leadership

Domain 2Objective 3

Managing Cloud Security GSLC Practice Questions (Page 5)

Part of the Technical Security Management domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~19–32 in this domain), expect 4–6 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

7concepts

Questions 21–25

21application · medium
A company experiences a security incident in its cloud environment. The incident response team needs to preserve evidence while minimizing the impact on production systems. Which action should the team take first?
Select an answer first
22application · medium
A company's cloud environment has been compromised, and the incident response team needs to contain the breach. The compromised resource is a virtual machine that is part of a production application. The team wants to isolate the VM without losing the ability to analyze it later. What should the team do?
Select an answer first
23application · medium
A multinational corporation is moving HR data to a cloud provider. The legal team notes that the data is subject to the EU General Data Protection Regulation (GDPR). The provider offers data centers in the EU, the US, and Asia. What is the most important contractual requirement to include in the cloud agreement?
Select an answer first
24foundation · easy
When a cloud customer processes personal data of EU residents, which legal framework imposes obligations on the customer as a data controller?
Select an answer first
25application · medium
A company's cloud environment has been compromised. The incident response team needs to determine the scope of the breach, but the cloud provider's logging is not enabled. What should the team do first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.

Managing Cloud Security GSLC Practice Questions (Page 5)

Questions 21–25

A company experiences a security incident in its cloud environment. The incident response team needs to preserve evidence while minimizing the impact on production systems. Which action should the team take first?

When a cloud customer processes personal data of EU residents, which legal framework imposes obligations on the customer as a data controller?

A company's cloud environment has been compromised. The incident response team needs to determine the scope of the breach, but the cloud provider's logging is not enabled. What should the team do first?

Keep studying — Technical Security Management