External Access and IAM Best Practices GCLD Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security engineer needs to grant a contractor temporary access to a cloud environment for a penetration test. The contractor needs broad access to compute resources but only for a specific time window. The engineer wants to ensure the access is automatically revoked and that all actions are logged. Which approach should they use?

   • AUse a role with a session duration policy that expires after the test window, and enable CloudTrail logging.
   • BShare the root account credentials with the contractor for the duration of the test.
   • CCreate a new IAM user with broad permissions and delete the user after the test.
   • DUse a pre-signed URL to grant access to the compute resources.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A cloud engineer needs to grant a third-party service temporary access to a cloud storage bucket for a one-time data migration. The migration is expected to take about 2 hours. The engineer wants to ensure the access is automatically revoked after the migration. Which approach should they use?

   • ACreate a new IAM user and attach a write-only policy, then delete the user after the migration.
   • BUse a pre-signed URL that expires in 2 hours.
   • CCreate a long-lived access key and delete it after the migration.
   • DShare the bucket's public URL with the third party.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company is designing a new cloud environment and needs to provide external partners with access to a set of APIs. The partners have their own identity providers and the company wants to use federated identity. The security team is concerned about the risk of token theft and wants to minimize the impact if a token is compromised. Which approach should they take?

   • AUse a VPN for all API access and do not use federated identity.
   • BUse short-lived tokens and require the partner to re-authenticate frequently.
   • CUse long-lived access tokens and rely on the partner's IdP to revoke them.
   • DUse a single shared API key for all partners.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security analyst notices that a vendor's service account is attempting to access resources outside of the vendor's normal working hours and from an unexpected geographic region. The account has broad permissions. What should the analyst do first?

   • AAdd a geolocation condition to the vendor's IAM policy to block the unexpected region.
   • BReview the access logs to confirm the activity and assess whether it is legitimate.
   • CImmediately revoke the vendor's access and re-provision it after investigation.
   • DChange the vendor's password and notify them of the incident.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary benefit of using federated identity for external users accessing cloud resources?

   • AIt automatically grants administrative access to all cloud resources
   • BIt eliminates the need for any authentication
   • CIt allows users to use their existing corporate credentials without creating a separate cloud password
   • DIt provides a direct network connection to the cloud
   Reveal Solution Discussion Select an answer first