What is the primary function of a cloud key management service (KMS)?

To monitor network traffic for malicious activity

To store passwords and other secrets

To provide multi-factor authentication for users

To generate, store, and manage encryption keys

A company stores sensitive data in a cloud storage bucket. The security team wants to ensure that only a specific application can access the bucket, and that all access is logged. The application runs on a compute instance. Which configuration best meets these requirements?

Create a user with programmatic access and share the credentials with the application.

Use an IAM role for the compute instance with a policy that grants access to the bucket, and enable bucket access logging.

Use a pre-signed URL for every access and do not enable logging.

Make the bucket public and rely on the application's IP address for access control.

What is the purpose of encrypting data in transit within cloud services?

To ensure data is deleted after transmission

To protect data from being read while it is being transmitted over a network

To allow data to be transmitted without any authentication

To protect data stored on disk from unauthorized access

A DevOps engineer at a software company needs to grant a CI/CD pipeline the ability to deploy a web application to a cloud environment. The pipeline runs on a schedule and does not have interactive user access. The company requires that the credentials used by the pipeline be automatically rotated and that the pipeline only have permission to deploy to the staging environment. Which approach should the engineer implement?

Use a user account with a password and MFA, and have the pipeline use the user's credentials to deploy to staging.

Use a workload identity federation that issues short-lived tokens to the pipeline, with an IAM role scoped to the staging environment.

Create a service account with a static key, grant it broad deployment permissions, and enable MFA on the service account.

Create a long-lived access key for a dedicated service account, store it in the pipeline's configuration, and manually rotate it quarterly.

An organization suspects that a cloud user's credentials were compromised. The user has administrative privileges. The incident response team needs to contain the incident while preserving evidence. What is the first step in the response process?

Revoke the user's credentials and disable the account, then begin collecting logs.

Delete the user account and all associated resources.

Collect logs first and then revoke credentials.

Change the user's password and notify the user.

GIAC Certified Incident Handler

Domain 4Objective 3

Securing Credentials and Data in the Cloud GCIH Practice Questions (Page 5)

Part of the Credential and Access Security domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~17–29 in this domain), expect 6–10 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

10concepts

Questions 21–25

21foundation · easy
What is the primary function of a cloud key management service (KMS)?
Select an answer first
22expert · hard
A company stores sensitive data in a cloud storage bucket. The security team wants to ensure that only a specific application can access the bucket, and that all access is logged. The application runs on a compute instance. Which configuration best meets these requirements?
Select an answer first
23foundation · easy
What is the purpose of encrypting data in transit within cloud services?
Select an answer first
24application · medium
A DevOps engineer at a software company needs to grant a CI/CD pipeline the ability to deploy a web application to a cloud environment. The pipeline runs on a schedule and does not have interactive user access. The company requires that the credentials used by the pipeline be automatically rotated and that the pipeline only have permission to deploy to the staging environment. Which approach should the engineer implement?
Select an answer first
25application · medium
An organization suspects that a cloud user's credentials were compromised. The user has administrative privileges. The incident response team needs to contain the incident while preserving evidence. What is the first step in the response process?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.