10 exam-style questions with answers and explanations, straight from our 1,030-question bank. Tap an answer to check yourself. When you're ready, take the scored version in the free practice test.
The GCLD exam has 75 questions and runs 2 hours.
These 10 free GCLD questions are organized by exam domain, so you can see how each part of the GIAC Cloud Security Essentials blueprint is tested. Reveal the answer and explanation under each question.
An exposed IAM user's access key is being used from an external host to download confidential S3 objects. The EC2 instance where the key was found has been isolated, yet new downloads continue. The bucket is private and its objects are encrypted. What should the responder contain next to stop this confirmed access path?
Correct answer: B - Deactivate the exposed key and restrict the compromised IAM user's permissions.
An Azure access review finds two assignments for an operations group: Subscription: Contributor SharedServices resource group: Reader The group should manage resources in the App resource group but only read resources in SharedServices. No other grants or deny assignments apply. Which set of assignments meets that requirement?
Correct answer: D - Remove subscription Contributor, assign Contributor on App, and retain Reader on SharedServices.
For one S3 bucket, an IAM user's identity policy allows GetObject and PutObject. Its permissions boundary allows GetObject and DeleteObject. These are the only applicable policies; all resource conditions match and neither policy contains an explicit deny. How does AWS evaluate the three actions?
Correct answer: D - GetObject is allowed; both PutObject and DeleteObject are denied.
"Integrity validation was enabled, so these CloudTrail files cannot have changed," an investigator says. The original log files and signed digest files are available for the whole period, but nobody has run validation. What would directly test the investigator's claim?
Correct answer: A - Verify the digest signatures and the referenced log-file hashes.
A client initiates an HTTPS connection to an EC2 server from TCP port 55000. The initial packet reaches server port 443, but its reply does not reach the client. Routing and security groups permit the connection. The subnet network ACL allows inbound TCP 443, but its only outbound allowance is destination TCP 443; a final deny covers other outbound traffic. Which rule change lets this connection proceed?
Correct answer: D - Add an outbound ACL allowance to client destination TCP 55000, before the deny.
One invoice has been accidentally deleted from an S3 bucket with Versioning Enabled. The current version is a delete marker; the immediately preceding version is the required invoice and remains intact. Other objects have valid changes made after the last backup. How can the operator restore normal reads of the invoice at its existing key without losing those changes?
Correct answer: A - Delete the current delete marker using its version ID.
Two DLP configurations are evaluated against the same 200 documents; 40 contain sensitive records. Configuration A flags 60 documents, including 36 sensitive documents. Configuration B flags 30 documents, including 27 sensitive documents. The team is considering B to reduce review work. Which evaluation correctly identifies the security tradeoff?
Correct answer: C - B has 90% precision and 67.5% recall; fewer false alarms come with more missed sensitive documents.
A GitHub Actions security review finds that contributor-controlled build scripts from a fork execute in a job holding production deployment credentials. External contributions still need to be tested. Which redesign removes the dangerous trust relationship?
Correct answer: C - Run fork tests without production authority; deploy reviewed code in an isolated trusted job.
A scheduled database-password rotation produces an uneven outage: newly started workers connect successfully, but older workers receive authentication failures. The secret manager and database hold matching current credentials. Every worker has the same workload role; older workers read the secret only at startup. There are no compromise indicators. These observations point to which repair?
Correct answer: B - Reload the current secret in the affected workers and retry their connections.
A dependency scan identifies a remotely exploitable flaw in a library packaged with a customer portal. The portal runs on a PaaS, and the provider has already patched the OS and language runtime. The application owner says, "The platform is managed, so this is the provider's patch." Which response correctly assigns the remaining work?
Correct answer: A - The application team must update the bundled library and redeploy the portal.
The GCLD exam also covers these domains. Drill them in the full free practice test:
The full bank has 1,020 more GCLD questions with explanations.
Continue in the free practice test →
View plans