[NEW] GIAC Cloud Security Automation (GCSA)

Secure Development Lifecycle (20%): Learn to implement security controls in every CI/CD phase, including automated remediation and compliance-as-code.

Infrastructure as Code (15%): Secure your provisioning using IaC principles and configuration management tools for version-controlled resources.

Container & Orchestration Security (15%): Deep dive into container hardening, Kubernetes API security, RBAC, and pod security policies.

Secrets Management (10%): Manage the full lifecycle of secrets, including rotation and integration with vault services.

Continuous Monitoring & Compliance (15%): Set up automated telemetry collection, compliance checks, and runtime observability.

Incident Response & Automation (10%): Build event-driven architectures to automate security alerts and remediation workflows.

B. Using a policy engine like Open Policy Agent (OPA) to scan templates against security rules.

C. Relying on the cloud provider’s default settings for all resources.

D. Deleting resources that fail compliance checks after they are already live in production.

E. Hardcoding security credentials directly into the deployment scripts.

F. Disabling the CI/CD pipeline to perform a monthly security audit.

Correct Answer: B

Explanation:

A (Incorrect): Manual review is slow and error-prone; it defeats the "automation" goal of the GCSA.

C (Incorrect): Default settings are often broad and do not meet specific organizational security requirements.

D (Incorrect): This is reactive; Compliance-as-Code aims to prevent non-compliant resources from being deployed in the first place.

E (Incorrect): This is a critical security vulnerability and violates Secrets Management principles.

F (Incorrect): Continuous monitoring and automation should not require stopping the delivery flow.

Question 2: In a Kubernetes environment, which component is primarily responsible for enforcing pod security policies and validating requests to the cluster?

B. Kube-proxy

C. Admission Controllers

D. CoreDNS

E. Container Runtime (Docker/containerd)

F. Cloud Provider API

Correct Answer: C

Explanation:

A (Incorrect): etcd is the key-value store for cluster data, not a security enforcement engine.

B (Incorrect): Kube-proxy manages network rules on nodes.

D (Incorrect): CoreDNS handles service discovery and name resolution.

E (Incorrect): The runtime executes the containers but does not manage Kubernetes-level security policies.

F (Incorrect): While the cloud API manages infrastructure, the internal cluster logic is handled by the Admission Controllers.

Question 3: A security team needs to automate the rotation of database credentials stored in a cloud secret manager. What is the most secure way to handle the "Lifecycle of secret creation and rotation"?

B. Using a Lambda or Cloud Function triggered by the secret manager to update the DB and the secret store simultaneously.

C. Mailing the new password to all developers every 30 days.

D. Storing the rotation logic in a public GitHub repository.

E. Manually typing the new secret into the console during a maintenance window.

F. Hardcoding the secret in the application's environment variables.

Correct Answer: B

Explanation:

A (Incorrect): Static credentials increase the risk of long-term exposure.

C (Incorrect): Passwords should never be shared via insecure communication channels like email.

D (Incorrect): Security logic and secrets should never be exposed in public repositories.

E (Incorrect): Manual rotation is not scalable and is prone to human error.

F (Incorrect): Hardcoding secrets is a major security risk and prevents rotation.

You can retake the exams as many times as you want

This is a huge original question bank

You get support from instructors if you have questions

Each question has a detailed explanation

Mobile-compatible with the Udemy app

30-days money-back guarantee if you're not satisfied