GIAC GCLD Certification Sample Questions
The purpose of this Sample Question Set is to provide you with information about the GIAC Cloud Security Essentials (GCLD) exam. These sample questions will make you very familiar with both the type and the difficulty level of the questions on the GCLD certification test. To get familiar with real exam environment, we suggest you try our Sample GIAC GCLD Certification Practice Exam. This sample practice exam gives you the feeling of reality and is a clue to the questions asked in the actual GIAC Cloud Security Essentials (GCLD) certification exam.
These sample questions are simple and basic questions that represent likeness to the real GIAC Cloud Security Essentials exam questions. To assess your readiness and performance with real-time scenario based questions, we suggest you prepare with our Premium GIAC GCLD Certification Practice Exam. When you solve real time scenario based questions practically, you come across many difficulties that give you an opportunity to improve.
GIAC GCLD Sample Questions:
01. Breaches are often discovered months after they begin, and a compliance investigation may look back over a long period. A team is setting how long to keep its cloud audit logs.
Which practice most directly preserves the audit trail for a late investigation?
a) Keep only the most recent logs and discard older ones promptly to reduce storage cost, relying on alerts to have caught anything important at the time.
b) Retain the control-plane audit logs long enough for investigation and compliance, in immutable storage.
c) Depend on real-time alerting alone, since anything worth investigating would have generated an alert when it occurred.
d) Store the logs on each source resource.
02. A team threat-models a workload made of an internet-facing API, an application tier, and a managed database, where each component authenticates to the next and the application assumes a workload identity to read from a managed secrets store. It wants to reason about where an attacker who crosses a boundary would gain new privileges.
Which boundary is the most security-relevant one that is distinctive to this cloud design?
a) The identity and authorization boundary that decides which principal may call which API.
b) The physical perimeter of the provider's data center that houses the servers for this workload.
c) The boundary between two virtual machines enforced by the provider's hypervisor.
d) The corporate office firewall between employees and the public internet.
03. Flow logs show an allowed outbound connection from a workload to an unfamiliar host, but not what was sent. The team wants the two steps that best advance the investigation.
Which two steps best advance it?
(Choose two.)
a) Check the destination against DNS and query logs and threat intelligence to determine whether it is known-malicious.
b) Take a targeted packet capture or inspect the host on that specific resource to characterize the payload where it is not encrypted.
c) Immediately block all outbound traffic across the entire account to be safe.
d) Conclude that data was exfiltrated based on the flow log's byte count to the host alone.
04. During a compliance audit, an assessor asks the team to show who modified a particular network security-group rule, and when, over the past quarter. The team must point to the cloud artifact that records that change.
Which source provides that evidence?
a) The management control-plane log of configuration-change calls.
b) The latest configuration-posture scan of the environment's current state.
c) The network flow log of the connections the rule allowed or denied.
d) The data-plane object-access log for the resources sitting behind the rule.
05. A threat model of an internet-facing service finds that the application fetches user-supplied URLs on the server side, and that the compute instance holds a role whose credentials the instance metadata service will return to any process able to reach that endpoint. The team decides to invest against the specific attacker path this exposes rather than against a generic list.
Which two controls most directly address this path?
(Choose two.)
a) Require the hardened, session-oriented metadata request flow and validate the outbound targets of the server-side fetch.
b) Enable object-level data-plane logging on the storage the application reads from.
c) Scope the instance's role to least privilege so credentials taken from the metadata service reach very little.
d) Encrypt all traffic between the application and its end users with transport-layer security so requests cannot be read as they cross the network.
06. In an orchestrated cluster, a compromised application container is the concern, and the team wants to bound both what that single container can do to the cloud account and how far it can move to other workloads.
Which two controls most directly limit the blast radius of one compromised container?
Choose two.)
a) Grant the container broad read access across the account so it can fetch whatever configuration or data it happens to need.
b) Run the container in privileged mode so security tooling can inspect it.
c) Run the container under a least-privilege task identity so its stolen credentials reach only what it strictly needs.
d) Apply network policy that restricts the container's traffic to only the services it must reach.
07. An auditor asks a company using a certified cloud provider to produce evidence for the controls the company itself owns under the shared-responsibility model. The provider has already supplied its own independent attestation covering the infrastructure it operates.
Which three of the following are evidence of the controls the customer owns, rather than the provider's?
(Choose three.)
a) The provider's physical-security certification for its data-center facilities.
b) Records of encryption and key management for the data the customer placed in the cloud.
c) Continuous configuration-compliance reports showing the customer's own resources checked against a security baseline.
d) The provider's independent third-party attestation report covering the infrastructure, platforms, and facilities that it alone operates.
e) Access-review records demonstrating least-privilege permissions on the customer's identities.
08. Two backend services exchange sensitive records over the internal network. The design must ensure that each record stays confidential and unaltered on the wire and that each service can verify it is really talking to the other and not an impostor on the same network.
Which control meets all of these needs?
a) Send the records with an API key in the request header so the receiver can authenticate the caller.
b) A mutually authenticated transport-layer channel, so each service presents a certificate the other validates, and the records stay confidential and integrity-protected as they cross the network.
c) Encrypt the records at rest in both services' stores, so the data is protected on each end of the exchange before and after it is sent.
d) Place a stateless network ACL between the two services to control which addresses may connect.
09. A security team operates workloads across several public-cloud providers under different service models, from IaaS instances to SaaS applications. Leadership asks which security responsibilities the team must own consistently, no matter which provider or model a given workload uses.
Which two responsibilities remain the customer's across every provider and service model?
(Choose two.)
a) Securing the physical facilities and hardware that run the providers' regions.
b) Classifying the data the workloads hold and enforcing its access and protection controls.
c) Governing the identities that can act in each environment and granting them least-privilege permissions.
d) Patching the host operating systems and the hypervisors that sit beneath every managed platform and SaaS application the team uses.
10. Disabling or deleting logging is often an intruder's first move so that their later actions go unrecorded. A team wants to ensure this specific action does not pass unnoticed.
Which control most directly catches it?
a) Alert on the control-plane event that stops, deletes, or reconfigures logging, since turning logging off is itself a logged management action.
b) Increase the retention period on the existing logs so more history is available.
c) Encrypt the log store at rest.
d) Rely on the data-plane logs of the affected resources to show that logging was turned off, because they record all activity within each resource in detail.
Answers:
|
Question: 01 Answer: b |
Question: 02 Answer: a |
Question: 03 Answer: a, b |
Question: 04 Answer: a |
Question: 05 Answer: a, c |
|
Question: 06 Answer: c, d |
Question: 07 Answer: b, c, e |
Question: 08 Answer: b |
Question: 09 Answer: b, c |
Question: 10 Answer: a |
Note: For any error in GIAC Cloud Security Essentials (GCLD) certification exam sample questions, please update us by writing an email on feedback@edusum.com.
