Securing Credentials and Data in the Cloud GCIH Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security analyst is investigating a potential cloud credential compromise. The analyst sees that a service account key was used to access a sensitive database, but the key was rotated 24 hours ago. The analyst also notices that the service account has a policy that allows it to create new keys. What is the most likely explanation for the continued use of the old key?

   • AThe rotation process failed and the old key is still active.
   • BThe key was not actually rotated and the analyst is mistaken.
   • CThe attacker used the service account's permission to create a new key and is using that new key.
   • DThe database access was from a legitimate application that still uses the old key.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following best describes a temporary token used in cloud environments?

   • AA long-lived secret that grants access to cloud APIs until manually revoked
   • BA short-lived credential that grants access to cloud resources for a limited time and expires automatically
   • CA credential that is stored in a secret management service and never expires
   • DA credential used to authenticate a human user to the cloud console
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company stores sensitive documents in a cloud storage bucket. The compliance team requires that only specific users can access the bucket and that all access is logged. The bucket currently has a public-read policy. What is the most secure configuration?

   • AEncrypt the bucket with server-side encryption and leave the public-read policy.
   • BKeep the public-read policy but add a bucket policy that requires MFA.
   • CRemove the public-read policy, apply a least-privilege IAM policy, and enable access logging.
   • DUse a pre-signed URL for all access and do not change the bucket policy.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is a key step in the lifecycle management of a cloud credential when an employee leaves the organization?

   • ASharing the credential with another employee
   • BChanging the credential to a temporary token
   • CImmediately revoking the credential and removing associated access
   • DLeaving the credential active in case the employee returns
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A large organization is migrating to a cloud environment and needs to manage credentials for both human users and automated workloads. The security team wants to avoid long-lived credentials for workloads and enforce MFA for all human users. However, some legacy workloads cannot use workload identity federation. What is the most secure approach to manage credentials for the legacy workloads?

   • AMigrate all legacy workloads to use workload identity federation, even if it requires significant refactoring.
   • BUse a single shared service account for all legacy workloads with a long-lived key, and store the key in a secret management service.
   • CUse a dedicated service account for each legacy workload with a long-lived key, and enforce MFA on the service account.
   • DCreate long-lived access keys for the legacy workloads and store them in a secret management service, with a policy to rotate them every 30 days.
   Reveal Solution Discussion Select an answer first