A company uses a cloud identity provider (IdP) to authenticate users to multiple SaaS applications. The security team wants to enforce a policy that blocks access from anonymous IP addresses and requires device compliance for all cloud app access. What should they configure?

A policy in each SaaS application to block anonymous IPs.

A firewall rule that blocks anonymous IPs at the network level.

Require MFA for all users and rely on the SaaS app's security features.

Conditional access policies in the IdP that evaluate IP reputation and device compliance.

A company uses a cloud identity provider (IdP) and wants to implement a zero-trust model. The security team wants to require MFA for all access, but the IT team is concerned about the user experience for a legacy application that does not support modern authentication protocols. Which approach best addresses this concern?

Exempt the legacy application from MFA to avoid user disruption.

Use a conditional access policy that requires MFA for the legacy application, but allow access from trusted locations without MFA.

Replace the legacy application with a modern application that supports MFA.

Deploy an application proxy that adds MFA to the legacy application.

A company uses Azure AD as its identity provider and has set up federation with AWS IAM using SAML. Users authenticate to Azure AD and then assume an AWS role. The security team wants to enforce MFA for AWS console access, but only for users outside the corporate network. What is the best way to achieve this?

Require MFA for all Azure AD users regardless of location.

Use a VPN to ensure all users are on the corporate network.

Configure AWS IAM role trust policy to require MFA in the SAML assertion.

Create a conditional access policy in Azure AD that requires MFA for the AWS SAML application when the location is not trusted.

A company uses a cloud identity platform to manage user access to AWS and Azure. The security team wants to implement a zero-trust model where access is granted based on user attributes and context, not just group membership. What is the best way to achieve this?

Create more granular groups in the identity platform and assign users to them.

Use MFA for all users and rely on that as the primary control.

Implement a single sign-on solution and rely on the cloud provider's default policies.

Use attribute-based access control (ABAC) policies in the cloud identity platform and cloud providers.

Which process is part of identity lifecycle management?

Encrypting data at rest in cloud storage.

Provisioning new user accounts with appropriate permissions.

Monitoring CPU usage of cloud virtual machines.

Configuring network firewalls to block malicious traffic.

GIAC Cloud Security Architecture and Design

Domain 1Objective 1

Cloud Identity GCAD Practice Questions (Page 1)

Part of the Identity and Access Management domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 3–5 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

5concepts

Questions 1–5

1application · medium
A company uses a cloud identity provider (IdP) to authenticate users to multiple SaaS applications. The security team wants to enforce a policy that blocks access from anonymous IP addresses and requires device compliance for all cloud app access. What should they configure?
Select an answer first
2expert · hard
A company uses a cloud identity provider (IdP) and wants to implement a zero-trust model. The security team wants to require MFA for all access, but the IT team is concerned about the user experience for a legacy application that does not support modern authentication protocols. Which approach best addresses this concern?
Select an answer first
3application · medium
A company uses Azure AD as its identity provider and has set up federation with AWS IAM using SAML. Users authenticate to Azure AD and then assume an AWS role. The security team wants to enforce MFA for AWS console access, but only for users outside the corporate network. What is the best way to achieve this?
Select an answer first
4application · medium
A company uses a cloud identity platform to manage user access to AWS and Azure. The security team wants to implement a zero-trust model where access is granted based on user attributes and context, not just group membership. What is the best way to achieve this?
Select an answer first
5foundation · easy
Which process is part of identity lifecycle management?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCAD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCAD” is a trademark of its owner, used for identification only.

Cloud Identity GCAD Practice Questions (Page 1)

Questions 1–5

A company uses a cloud identity provider (IdP) to authenticate users to multiple SaaS applications. The security team wants to enforce a policy that blocks access from anonymous IP addresses and requires device compliance for all cloud app access. What should they configure?

A company uses a cloud identity platform to manage user access to AWS and Azure. The security team wants to implement a zero-trust model where access is granted based on user attributes and context, not just group membership. What is the best way to achieve this?

Which process is part of identity lifecycle management?

Keep studying — Identity and Access Management