Securing Credentials and Data in the Cloud GCIH Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which cloud service is commonly used to audit API calls and credential usage?

   • ACloud logging and audit services such as AWS CloudTrail or Azure Monitor
   • BA load balancer
   • CA content delivery network (CDN)
   • DA virtual private network (VPN) service
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security auditor discovers that a developer has been storing a cloud storage access key in the source code of a public repository. The key has been exposed for 30 days. The organization uses a cloud secret management service for other applications. What is the FIRST action the incident handler should take to address this exposure?

   • AChange the repository visibility to private and inform the developer to remove the key from the code.
   • BDelete the public repository to prevent further exposure of the key.
   • CCreate a new access key and update the application to use the new key, leaving the old key in place for monitoring.
   • DRotate the exposed access key immediately and then review access logs for any unauthorized usage.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company is migrating its user accounts to a cloud identity provider. The security team wants to enforce MFA for all administrative users. However, some administrators use legacy applications that do not support modern MFA protocols like TOTP or WebAuthn. What is the most secure approach to enforce MFA while accommodating the legacy applications?

   • AUse a conditional access policy that requires MFA for all administrators, but allows access from legacy applications using a separate policy that requires a compliant device.
   • BDisable the legacy applications and require administrators to use modern applications that support MFA.
   • CCreate a separate administrative account for each administrator that does not require MFA for legacy application access.
   • DExempt the administrators using legacy applications from MFA to avoid disrupting their workflow.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   After revoking a compromised cloud credential, what is an important next step in the incident response process?

   • AImmediately reissuing the same credential to the affected user
   • BInvestigating how the credential was compromised and what actions were taken
   • CIgnoring the incident if the credential was not used
   • DDeleting all audit logs to protect privacy
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is a common method to enforce MFA for all users in a cloud environment?

   • ARequiring users to change their passwords every 30 days
   • BDisabling all user accounts that do not have MFA enabled
   • CUsing a shared MFA token for all users
   • DCreating a conditional access policy that requires MFA for all cloud users
   Reveal Solution Discussion Select an answer first