A company is implementing federated identity for external partners. The partners' identity provider (IdP) sends a group membership claim, but the cloud application maps groups to roles. The security team wants to ensure that only partners who have completed a security training course can access sensitive resources. How should they enforce this requirement?

Ask the partner IdP to include a custom claim indicating training completion, and map that claim to a role in the cloud.

Require all partners to use multi-factor authentication to access sensitive resources.

Create a local group in the cloud and manually add partners who have completed training.

Use a geolocation condition to restrict access to partners from certain countries.

A cloud engineer needs to grant a third-party auditor temporary access to read log files in a cloud storage bucket. The auditor's access should expire automatically after 24 hours and must not be usable after that time. What is the most appropriate way to grant this access?

Add the auditor's IP address to the bucket's access policy

Use the cloud provider's security token service to issue short-lived credentials with a 24-hour expiration

Grant the auditor IAM read-only role and manually revoke it after 24 hours

Create a long-lived access key and share it with the auditor

A cloud provider offers a service that issues temporary credentials for external users. What is a key characteristic of these temporary credentials?

They have a limited lifetime and automatically expire

They are the same as long-term access keys

They are stored in the user's browser cache

They are valid indefinitely until revoked

A company is implementing SAML federation with a partner. The partner's identity provider will send a SAML assertion that includes the user's email address. The company's cloud application needs to map the email to a specific IAM role. What is the recommended way to assign the role?

Use the email address to look up a role in a local database

Assign the same IAM role to all partner employees

Create a separate IAM user for each partner employee and map the email to that user

Use a SAML attribute in the assertion to specify the IAM role

GIAC Cloud Security Essentials

Domain 3Objective 1

External Access and IAM Best Practices GCLD Practice Questions (Page 2)

Part of the Identity, Access, and Secrets domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 4–6 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

6concepts

Questions 6–10

6expert · hard
A company is implementing federated identity for external partners. The partners' identity provider (IdP) sends a group membership claim, but the cloud application maps groups to roles. The security team wants to ensure that only partners who have completed a security training course can access sensitive resources. How should they enforce this requirement?
Select an answer first
7application · medium
A cloud engineer needs to grant a third-party auditor temporary access to read log files in a cloud storage bucket. The auditor's access should expire automatically after 24 hours and must not be usable after that time. What is the most appropriate way to grant this access?
Select an answer first
8foundation · easy
An organization grants external auditors read-only access to a cloud storage bucket. Which IAM best practice does this primarily demonstrate?
Select an answer first
9foundation · easy
A cloud provider offers a service that issues temporary credentials for external users. What is a key characteristic of these temporary credentials?
Select an answer first
10expert · hard
A company is implementing SAML federation with a partner. The partner's identity provider will send a SAML assertion that includes the user's email address. The company's cloud application needs to map the email to a specific IAM role. What is the recommended way to assign the role?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCLD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCLD” is a trademark of its owner, used for identification only.

External Access and IAM Best Practices GCLD Practice Questions (Page 2)

Questions 6–10

A cloud engineer needs to grant a third-party auditor temporary access to read log files in a cloud storage bucket. The auditor's access should expire automatically after 24 hours and must not be usable after that time. What is the most appropriate way to grant this access?

An organization grants external auditors read-only access to a cloud storage bucket. Which IAM best practice does this primarily demonstrate?

A cloud provider offers a service that issues temporary credentials for external users. What is a key characteristic of these temporary credentials?

A company is implementing SAML federation with a partner. The partner's identity provider will send a SAML assertion that includes the user's email address. The company's cloud application needs to map the email to a specific IAM role. What is the recommended way to assign the role?

Keep studying — Identity, Access, and Secrets