GIAC GCSA QUESTIONS AND ANSWERS | VERIFIED
AND WELL DETAILED ANSWERS | PLUS RATIONALES
| GUARANTEED PASS | LATEST EXAM UPDATE |
EXAM PREP | STUDY GUIDE | PRACTICE TEST
,Domain 1: Cloud Security Fundamentals & Shared Responsibility (Q1–15)
Q1. Under the shared responsibility model, which is the customer's responsibility in IaaS?
A) Physical security of data centers
B) Patching the hypervisor
C) Securing guest OS and applications
D) Network fabric isolation
Answer: C
Rationale: In IaaS, the provider secures the physical layer and hypervisor; the customer is responsible for the
guest OS, middleware, applications, and data. A and B are provider responsibilities; D is provider-managed.
Q2. Which cloud service model places the MOST security responsibility on the provider?
A) IaaS
,B) PaaS
C) SaaS
D) FaaS
Answer: C
Rationale: In SaaS, the provider manages everything up to the application layer. The customer is mainly
responsible for data and access management. IaaS/PaaS/FaaS leave more layers to the customer.
Q3. What is the primary purpose of a cloud security posture management (CSPM) tool?
A) Encrypt data at rest
B) Continuously detect misconfigurations and compliance drift
C) Replace SIEM
D) Manage identity federation
Answer: B
, Rationale: CSPM tools continuously assess cloud configurations against benchmarks (CIS, NIST) and detect
drift. Encryption and federation are separate controls; CSPM complements SIEM.
Q4. Which is an example of a cloud-native security control?
A) A third-party virtual firewall appliance
B) AWS Security Groups
C) An on-premises IDS
D) A physical HSM
Answer: B
Rationale: Security Groups are native to AWS and managed via API. The others are traditional or third-party
controls adapted to cloud.
Q5. Which principle is MOST important when designing cloud IAM?
AND WELL DETAILED ANSWERS | PLUS RATIONALES
| GUARANTEED PASS | LATEST EXAM UPDATE |
EXAM PREP | STUDY GUIDE | PRACTICE TEST
,Domain 1: Cloud Security Fundamentals & Shared Responsibility (Q1–15)
Q1. Under the shared responsibility model, which is the customer's responsibility in IaaS?
A) Physical security of data centers
B) Patching the hypervisor
C) Securing guest OS and applications
D) Network fabric isolation
Answer: C
Rationale: In IaaS, the provider secures the physical layer and hypervisor; the customer is responsible for the
guest OS, middleware, applications, and data. A and B are provider responsibilities; D is provider-managed.
Q2. Which cloud service model places the MOST security responsibility on the provider?
A) IaaS
,B) PaaS
C) SaaS
D) FaaS
Answer: C
Rationale: In SaaS, the provider manages everything up to the application layer. The customer is mainly
responsible for data and access management. IaaS/PaaS/FaaS leave more layers to the customer.
Q3. What is the primary purpose of a cloud security posture management (CSPM) tool?
A) Encrypt data at rest
B) Continuously detect misconfigurations and compliance drift
C) Replace SIEM
D) Manage identity federation
Answer: B
, Rationale: CSPM tools continuously assess cloud configurations against benchmarks (CIS, NIST) and detect
drift. Encryption and federation are separate controls; CSPM complements SIEM.
Q4. Which is an example of a cloud-native security control?
A) A third-party virtual firewall appliance
B) AWS Security Groups
C) An on-premises IDS
D) A physical HSM
Answer: B
Rationale: Security Groups are native to AWS and managed via API. The others are traditional or third-party
controls adapted to cloud.
Q5. Which principle is MOST important when designing cloud IAM?
