GIAC GCSA Certification Sample Questions
The purpose of this Sample Question Set is to provide you with information about the GIAC Cloud Security Automation (GCSA) exam. These sample questions will make you very familiar with both the type and the difficulty level of the questions on the GCSA certification test. To get familiar with real exam environment, we suggest you try our Sample GIAC GCSA Certification Practice Exam. This sample practice exam gives you the feeling of reality and is a clue to the questions asked in the actual GIAC Cloud Security Automation (GCSA) certification exam.
These sample questions are simple and basic questions that represent likeness to the real GIAC Cloud Security Automation exam questions. To assess your readiness and performance with real-time scenario based questions, we suggest you prepare with our Premium GIAC GCSA Certification Practice Exam. When you solve real time scenario based questions practically, you come across many difficulties that give you an opportunity to improve.
GIAC GCSA Sample Questions:
01. Support engineers occasionally need the permissions of an automation account that already exists in a cluster. Today they check that account's kubeconfig out of a vault and use it directly.
The platform team is asked for an arrangement in which every action is attributable to the individual who took it, without granting any person the automation account's permissions directly. Which arrangement meets both requirements?
a) Bind the automation account's role to a support group and put the engineers in that group, using the membership record to show who could have acted.
b) Keep the shared credential and require an incident reference in the change record, reading the control-plane audit log to establish which requests were made and at what time.
c) Have each engineer authenticate as themselves and act as the automation account, so the request carries both identities and the record names the person.
d) Issue each engineer a client certificate that presents the automation account's name, so the grants already in place apply without change.
02. An API gateway validates an end-user access token minted for the orders service and forwards the request inward. The orders service has to call the shipping service on that user's behalf, and the shipping service enforces per-user entitlements from claims it validates itself.
A developer proposes forwarding the same token from orders to shipping. What should be done instead?
a) Forward the token as proposed: shipping verifies the same issuer and the same signing key, and the audience claim is checked once, at the gateway.
b) Obtain a token minted for the shipping service before the call, by exchanging the user's token at the identity provider.
c) Widen the audience of the token the gateway accepts so that it covers the services in the call chain, which lets one validated token serve every hop.
d) Call shipping with the orders service's own workload identity, carrying the user's identifier in a request header that shipping reads its entitlements from.
03. Six weeks after an incident, responders want to inspect the exact image a compromised workload ran. The deployment record names the image by digest. The registry deletes stored digests that no tag references once a retention period passes, and the tag that once pointed at that digest has been moved several times since.
What has to change so that a record like this is inspectable next time?
a) Hold images named in a deployment record back from the registry's deletion, or copy them into a store that keeps them for as long as the record is expected to answer questions, since a digest identifies an image without preserving it.
b) Rely on the software bill of materials, which is retained with the release record and enumerates what the image contained, so the image itself is no longer needed.
c) Publish the build's provenance attestation to a transparency log, whose entries are permanent, so the log holds the image once the registry no longer does.
d) Rebuild the image from the source revision the attestation names, which reproduces the same digest and therefore the same artifact.
04. An infrastructure change is handled as follows: the tool computes the change for the target environment and writes it to a file, a reviewer approves that file, and the apply step consumes it. One approved change waited eight days, during which an unrelated emergency fix was applied to the same environment by another run.
What should happen to the approved change?
a) It can be applied without recomputation as long as the repository revision it came from is unchanged, since the file is derived from the declarations.
b) It has to be recomputed and reviewed again, because it was computed against the environment as it stood eight days ago.
c) It can be applied for the resources it creates, since a create action is self-contained, while the updates and deletions in it are recomputed when the apply runs.
d) It can be applied as it stands, because the file states the desired end state for that environment and applying it brings the environment to what was reviewed.
05. On one morning a team tightens a hardening requirement in its configuration-management definition and adds the equivalent rule to the continuous evaluation that runs against the platform's inventory of instances. Hosts run the definition once, overnight.
By the afternoon the evaluation reports most instances failing the new rule, while the configuration-management report from the previous night still shows the fleet converged. What accounts for the two reports?
a) The rule and the definition express the requirement differently, so the disagreement lies in the mapping between them rather than in the state of any instance.
b) The definition's report came from inspecting each host directly, so it describes the hosts, while the evaluation reads platform metadata that lags what is on them, so the instances already carry the tightened setting and the inventory the evaluation reads has not caught up with them.
c) The evaluation judged every instance against the new rule as soon as it ran, while the definition changes nothing on a host until that host's next run, so the instances are genuinely failing and converge overnight.
d) The evaluation is serving its previous result set and will agree with the definition once it has completed a full pass over the inventory.
06. Every service is documented as authenticating its users through the organization's identity provider. A contractor's engagement ends and their provider account is disabled the same day. A month later an access review finds they can still sign in to one internal service.
What is the most likely explanation?
a) Their token had not yet expired, so the session continued after the account was disabled.
b) That service also keeps its own user records and can authenticate against them directly, so disabling the provider account left a second path open.
c) The service caches successful sign-in results from the provider and serves the cached answer on later attempts rather than asking the provider again each time.
d) The provider blocks new sign-ins but leaves the account's group memberships in place, and that service authorizes on the group claim rather than on the account itself.
07. The gateway validates each external user's token and then sets an internal header naming the authenticated user, which every service behind it trusts. A penetration test sends the gateway a request that already carries that header, naming an administrator, alongside a valid token for an ordinary user.
What must the gateway do about the inbound header?
a) Reject the request only when the inbound header names a user other than the token's subject, since a matching value tells the services nothing they would not have been told anyway.
b) Add a signature over its own header and pass any inbound copy through, since a service that verifies the signature disregards an unsigned value.
c) Nothing at the gateway; apply network policy so that only the gateway can reach the services, which makes the header safe whatever it contains.
d) Remove any copy of it from the incoming request before writing its own so that the value a service reads can only have been produced by the gateway.
08. A platform team runs a generator that watches flows between workloads and appends each newly observed destination to the source workload's egress allow-list, so that policies stay current without anyone editing them by hand.
An incident review establishes that a compromised pod in the analytics namespace sent data to an external host for two days before the activity was noticed. What does the review have to conclude about the generated policy?
a) Additions take effect for a workload the next time its pods are created, so the replicas that were running continued under the rules in force when they started, and the destination enters the policy only for pods scheduled after the generator recorded it.
b) The connections the compromised pod made were observed like any other flow, so the destination was added as a permitted egress and the policy now authorizes the path the attacker used.
c) The generated rules cover flows the generator can attribute to a workload at both ends, so an external destination was never a candidate for inclusion, and the list this workload carries names only the services inside the cluster that it has spoken to.
d) Nothing the generator added was involved, because a workload that no policy selects for egress is unrestricted in that direction anyway.
09. Every production resource is declared in Terraform and applied by the pipeline, yet the weekly drift check reports differences most weeks. Engineers retain roles that let them change production resources directly, and they use them during incidents.
Which two changes reduce drift at its source?
(Choose two.)
a) Provide an audited, time-bounded elevation path for incidents, so an emergency change stays possible, is recorded, and is known to need folding back into the code.
b) Withdraw standing write access from human identities in production, so that the pipeline is the only routine path by which a resource changes.
c) Have the drift check re-apply the declaration automatically whenever it finds a difference.
d) Run the drift check more often, so that changes made outside the pipeline are found closer to when they happen.
10. Secret scanning reports that a working cloud access key was committed to a service's repository two days ago. The posture platform records it as a critical finding, and the deployment gate blocks the service's next release until the finding is resolved.
How should the team assess the gate's behavior on this finding?
a) The block does nothing about the exposure, which ends when the key is revoked and reissued, so this class of finding needs a response path that does not wait on a release.
b) The finding should clear once the key is removed from the current files, since the artifact the pipeline builds no longer contains it.
c) The block is right, because the policy exists to stop a release that carries an unremediated critical finding, and a live credential sitting in a repository is critical by any measure of severity anyone applies.
d) The block is right, because it stops a build carrying the exposed credential from reaching production.
Answers:
|
Question: 01 Answer: c |
Question: 02 Answer: b |
Question: 03 Answer: a |
Question: 04 Answer: b |
Question: 05 Answer: c |
|
Question: 06 Answer: b |
Question: 07 Answer: d |
Question: 08 Answer: b |
Question: 09 Answer: a, b |
Question: 10 Answer: a |
Note: For any error in GIAC Cloud Security Automation (GCSA) certification exam sample questions, please update us by writing an email on feedback@edusum.com.
