A company uses a SaaS application for HR management. The security team wants to reduce the risk of account takeover for privileged users. Which control is MOST effective and within the customer's responsibility?

Request the SaaS provider's SOC 2 report.

Implement a web application firewall in front of the SaaS application.

Conduct a penetration test of the SaaS provider's infrastructure.

Enforce multi-factor authentication for all HR administrators.

Which of the following is the first step in detecting a cloud-based incident?

Collecting and analyzing cloud logs

Isolating the affected virtual machine

A security analyst notices that a cloud storage bucket is configured with a policy that allows 'Everyone' to have 'Write' access. What is the MOST likely risk associated with this configuration?

Denial of service by exhausting storage quota.

Data exfiltration by unauthorized users.

Data tampering or malware distribution.

Account takeover of the cloud account.

GIAC Cyber Incident Leader

Domain 1Objective 1

Cloud Attacks GCIL Practice Questions (Page 9)

Part of the Attack Types and Vectors domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~17–26 in this domain), expect 3–5 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

5concepts

Questions 41–43

41application · medium
A company uses a SaaS application for HR management. The security team wants to reduce the risk of account takeover for privileged users. Which control is MOST effective and within the customer's responsibility?
Select an answer first
42foundation · easy
Which of the following is the first step in detecting a cloud-based incident?
Select an answer first
43application · medium
A security analyst notices that a cloud storage bucket is configured with a policy that allows 'Everyone' to have 'Write' access. What is the MOST likely risk associated with this configuration?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCIL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIL” is a trademark of its owner, used for identification only.

Cloud Attacks GCIL Practice Questions (Page 9)

Questions 41–43

A company uses a SaaS application for HR management. The security team wants to reduce the risk of account takeover for privileged users. Which control is MOST effective and within the customer's responsibility?

Which of the following is the first step in detecting a cloud-based incident?

A security analyst notices that a cloud storage bucket is configured with a policy that allows 'Everyone' to have 'Write' access. What is the MOST likely risk associated with this configuration?

Keep studying — Attack Types and Vectors