External Access and IAM Best Practices GCLD Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company has a cloud application that is accessed by employees from multiple countries. The security team wants to block access from countries where the company does not operate. Which IAM policy condition should be used?

   • ARequire the user to be in a specific Active Directory group.
   • BRequire multi-factor authentication for all users.
   • CSet a short session duration for all users.
   • DUse a geolocation condition that allows access only from approved countries.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company is about to onboard a new external vendor who will manage a specific cloud database. The vendor's staff will need to perform routine maintenance but must not be able to modify IAM policies or access other databases. Which IAM best practice should be applied?

   • AGrant the vendor's staff the same permissions as internal database administrators
   • BAllow the vendor to use a shared IAM user with broad permissions
   • CCreate a custom IAM role with only the database maintenance permissions required
   • DProvide the vendor with the root account credentials
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company has a hybrid cloud environment and wants to allow a small number of administrators to access management interfaces from the internet. The administrators work from home and have dynamic IP addresses. The company wants to avoid exposing the management interfaces directly to the internet. Which access model should they use?

   • AA bastion host with IP allowlisting for the administrators' home IPs.
   • BFederated identity with SAML for the administrators.
   • CA VPN with multi-factor authentication for the administrators.
   • DDirect internet-facing access to the management interfaces.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company has a legacy application that cannot support modern federation protocols. External users must access this application over the internet. The security team wants to add a layer of authentication and control without modifying the application. Which external access model should be used?

   • AA direct database connection from external users
   • BA site-to-site VPN for each external user
   • CA reverse proxy that enforces authentication and session controls
   • DDirect internet exposure with a strong password
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company uses federated identity to allow external partners to access a cloud application. The partners' users are assigned to groups that map to roles in the cloud. The company wants to ensure that partners only have the permissions necessary for their job function and that access is reviewed regularly. Which combination of practices should be implemented?

   • AAssign each partner user a unique role and conduct quarterly access reviews.
   • BCreate local accounts for each partner and assign permissions individually.
   • CUse group-based role assignments and conduct quarterly access reviews.
   • DGrant all partners the same broad role and review access annually.
   Reveal Solution Discussion Select an answer first